swarph-cli 0.20.0__tar.gz → 0.22.0__tar.gz

{swarph_cli-0.20.0/src/swarph_cli.egg-info → swarph_cli-0.22.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: swarph-cli
-Version: 0.20.0
+Version: 0.22.0
 Summary: The `swarph` binary — a multi-LLM CLI and mesh-gateway client + bundled server (`swarph gateway`): one-shot prompts across providers, interactive `chat`, multi-provider `spawn` (claude/codex/antigravity via a ProviderMembrane with subprocess billing-scrub), `mesh` send/inbox/register, `brain-ask` over the swarph-brain (gbrain) semantic memory, git-backed `assisted_memory`, session `import`, and a stranded-session `watchdog`.
 Author: Pierre Samson, Claude Opus
 License: MIT
@@ -36,6 +36,7 @@ Requires-Dist: fastapi>=0.115; extra == "gateway"
 Requires-Dist: uvicorn[standard]>=0.32; extra == "gateway"
 Requires-Dist: pydantic>=2.9; extra == "gateway"
 Requires-Dist: croniter>=6.2; extra == "gateway"
+Requires-Dist: PyJWT[crypto]>=2.8; extra == "gateway"
 Provides-Extra: service
 Requires-Dist: fastapi>=0.115; extra == "service"
 Requires-Dist: uvicorn[standard]>=0.32; extra == "service"

{swarph_cli-0.20.0 → swarph_cli-0.22.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "swarph-cli"
-version = "0.20.0"
+version = "0.22.0"
 description = "The `swarph` binary — a multi-LLM CLI and mesh-gateway client + bundled server (`swarph gateway`): one-shot prompts across providers, interactive `chat`, multi-provider `spawn` (claude/codex/antigravity via a ProviderMembrane with subprocess billing-scrub), `mesh` send/inbox/register, `brain-ask` over the swarph-brain (gbrain) semantic memory, git-backed `assisted_memory`, session `import`, and a stranded-session `watchdog`."
 readme = "README.md"
 license = { text = "MIT" }
@@ -69,6 +69,9 @@ gateway = [
     "uvicorn[standard]>=0.32",
     "pydantic>=2.9",
     "croniter>=6.2",
+    # B1 Meta-Edge identity: verify RS256 SSO JWTs (the gateway TRUSTS, never
+    # signs). [crypto] pulls in `cryptography` for RSA signature verification.
+    "PyJWT[crypto]>=2.8",
 ]
 # `swarph service serve` stands up a $0 subscription-LLM HTTP lane. Same
 # FastAPI/uvicorn stack as the gateway, behind its own extra so the core

{swarph_cli-0.20.0 → swarph_cli-0.22.0}/src/swarph_cli/__init__.py

@@ -16,6 +16,6 @@ The architecture splits CLI from substrate so:
 
 from __future__ import annotations
 
-__version__ = "0.20.0"
+__version__ = "0.22.0"
 
 __all__ = ["__version__"]

{swarph_cli-0.20.0 → swarph_cli-0.22.0}/src/swarph_cli/commands/spawn.py

@@ -24,6 +24,7 @@ for users (alpha #891 D2).
 from __future__ import annotations
 
 import argparse
+import json
 import os
 import shutil
 import subprocess
@@ -445,7 +446,13 @@ def _build_agy_argv(
     cell: Cell, no_starter: bool, passthrough: list[str]
 ) -> list[str]:
     argv = ["agy"]
-    
+
+    # Resume THIS cwd's conversation. agy keys sessions internally by the full
+    # workspace path and starts FRESH gracefully when there's none (gemini-researcher
+    # verified live 2026-07-01), so --continue is unconditional — no guard, and NOT
+    # keyed on ~/.gemini/history/ (a retired gemini-cli path antigravity never writes).
+    argv.append("--continue")
+
     # codex is adding cell.sandbox; default ON, only off on explicit falsy
     sandbox_attr = getattr(cell, "sandbox", None)
     if sandbox_attr is not None:
@@ -460,22 +467,64 @@ def _build_agy_argv(
     argv.extend(["--add-dir", str(cell.cwd)])
     
     if not no_starter and cell.starter_prompt_path:
-        argv.extend(["--prompt-interactive", read_starter_prompt(cell)])
-    
+        starter = read_starter_prompt(cell)
+        if starter:  # skip an empty starter file (matches claude/grok membranes)
+            argv.extend(["--prompt-interactive", starter])
+
     argv.extend(passthrough)
     return argv
 
 
+def _newest_codex_session_for_cwd(cwd, sessions_root=None):
+    """Newest codex session_id recorded for this cwd (interactive, not codex_exec), or None.
+    Codex `--last` is global; swarph does the per-cwd selection. Never raises."""
+    import glob
+    root = Path(sessions_root) if sessions_root else (Path.home() / ".codex" / "sessions")
+    try:
+        files = sorted(glob.glob(str(root / "**" / "rollout-*.jsonl"), recursive=True))
+    except OSError:
+        return None
+    # codex records os.getcwd() (realpath-resolved) while cell.cwd may be a logical
+    # path — accept either so a symlinked cwd still matches (never a false fresh).
+    try:
+        targets = {str(cwd), str(Path(cwd).resolve())}
+    except OSError:
+        targets = {str(cwd)}
+    # sorted() is ascending (zero-padded YYYY/MM/DD + ISO-ts in the path), so walk
+    # from the NEWEST end and return the first cwd match — no need to read older
+    # files. isinstance guards keep "never raises" airtight for a non-dict first line.
+    for f in reversed(files):
+        try:
+            with open(f) as fh:
+                meta = json.loads(fh.readline())
+        except (OSError, ValueError):
+            continue
+        if not isinstance(meta, dict):
+            continue
+        pl = meta.get("payload", meta)
+        if not isinstance(pl, dict):
+            continue
+        if pl.get("cwd") in targets and pl.get("originator") != "codex_exec":
+            sid = pl.get("session_id") or pl.get("id")
+            if sid:  # some older sessions record a null id — skip to the next-newest match
+                return sid
+    return None
+
+
 def _build_codex_argv(cell: Cell, passthrough: list[str]) -> list[str]:
-    argv = [
-        "codex",
+    sid = _newest_codex_session_for_cwd(cell.cwd)
+    if sid:
+        argv = ["codex", "resume", sid]
+    else:
+        argv = ["codex"]
+    argv.extend([
         "-C",
         str(cell.cwd),
         "-s",
         _codex_sandbox(cell),
         "-a",
         _CODEX_APPROVAL,
-    ]
+    ])
     argv.extend(passthrough)
     return argv
 
@@ -569,6 +618,43 @@ def _grok_env(cell: Cell) -> dict[str, str]:
     return env
 
 
+def _git_identity_env(cell: Cell) -> dict[str, str]:
+    """Per-cell git author/committer identity for the spawned session.
+
+    So a cell's commits are attributable to IT — the RACI ownership reconcile key
+    — instead of folding into a shared global ``git config user.name`` (which is
+    why co-located cells were previously indistinguishable in git history). Every
+    membrane merges this into the child env before exec, so it works uniformly
+    across claude/codex/antigravity/grok.
+
+    Identity resolution:
+      * default ``GIT_AUTHOR_NAME`` = the cell's MESH name (``cell.name`` — e.g.
+        ``lab-ovh``/``science-claude``, NOT the spawn ``role``), email
+        ``<name>@brainsurfing.tech``;
+      * an optional ``git_identity: {name, email}`` block in the cell.yaml (carried
+        through ``cell.extra``, so no schema change) overrides either field.
+
+    The cell identity intentionally WINS over any inherited ``GIT_AUTHOR_*`` (the
+    cell is the author), so the membranes ``.update()`` the env with this last.
+    """
+    name = cell.name
+    email = f"{cell.name}@brainsurfing.tech"
+    extra = getattr(cell, "extra", None)
+    if isinstance(extra, dict):
+        gid = extra.get("git_identity")
+        if isinstance(gid, dict):
+            if gid.get("name"):
+                name = str(gid["name"])
+            if gid.get("email"):
+                email = str(gid["email"])
+    return {
+        "GIT_AUTHOR_NAME": name,
+        "GIT_AUTHOR_EMAIL": email,
+        "GIT_COMMITTER_NAME": name,
+        "GIT_COMMITTER_EMAIL": email,
+    }
+
+
 def _link_grok_auth(link: Path) -> None:
     """Symlink the operator's ``~/.grok/auth.json`` to ``link`` for $0 OIDC.
 
@@ -1242,6 +1328,7 @@ class ClaudeMembrane(ProviderMembrane):
         # was already injected via --append-system-prompt, so it skips double-
         # injection. The env carries to the child either way.
         env = _claude_env()
+        env.update(_git_identity_env(cell))  # per-cell git author (RACI attribution)
 
         # Per-OS launch mechanism — the SAME split as the tmux attach, for the
         # SAME reason:
@@ -1294,8 +1381,10 @@ class CodexMembrane(ProviderMembrane):
         )
 
     def launch(self, cell: Cell, binary: str, argv: list[str]) -> int:
+        env = _scrubbed_codex_env()
+        env.update(_git_identity_env(cell))  # per-cell git author (RACI attribution)
         try:
-            os.execve(binary, argv, _scrubbed_codex_env())
+            os.execve(binary, argv, env)
         except OSError as exc:
             print(f"swarph spawn: exec failed: {exc}", file=sys.stderr)
             return 1
@@ -1333,8 +1422,10 @@ class AntigravityMembrane(ProviderMembrane):
     def launch(self, cell: Cell, binary: str, argv: list[str]) -> int:
         # execve carries exactly the scrubbed env to the child without mutating
         # this process's os.environ first (so a failed exec leaves us intact).
+        env = _agy_env()
+        env.update(_git_identity_env(cell))  # per-cell git author (RACI attribution)
         try:
-            os.execve(binary, argv, _agy_env())
+            os.execve(binary, argv, env)
         except OSError as exc:
             print(f"swarph spawn: exec failed: {exc}", file=sys.stderr)
             return 1
@@ -1413,6 +1504,7 @@ class GrokMembrane(ProviderMembrane):
         # Isolated-HOME + billing-scrubbed env carried to grok without mutating
         # this process's os.environ first (a failed exec leaves us intact).
         env = _grok_env(cell)
+        env.update(_git_identity_env(cell))  # per-cell git author (RACI attribution)
         # Per-OS launch — the SAME split as claude.launch (v0.12.1 fix): on
         # Windows os.exec* is emulated as spawn-and-exit (not a real replace),
         # which collapses the tmux pane (its root command exits, orphaning grok);

{swarph_cli-0.20.0 → swarph_cli-0.22.0}/src/swarph_cli/gateway/schema.sql

@@ -20,7 +20,15 @@ CREATE TABLE IF NOT EXISTS claude_peers (
   ratified INTEGER NOT NULL DEFAULT 0,   -- Phase 5.5: server-side §15 contract gate
   ratified_at TIMESTAMP,
   ratified_by TEXT,                      -- canonical witness peer name
-  ratification_reason TEXT
+  ratification_reason TEXT,
+  -- B2 login-scoped registry (META_EDGE_IDENTITY_CONTRACT.md): the Meta-Edge
+  -- canonical user id (`sub`) that OWNS this cell — the "node-in-your-tailnet"
+  -- relationship. NULLABLE + additive: lab peers (shared/per-peer token
+  -- registration) land owner=NULL and stay globally visible; only cells
+  -- registered via a Meta-Edge identity JWT or cell-join key carry an owner,
+  -- which scopes them to that user on GET /peers. Existing DBs get this column
+  -- via the idempotent ALTER in server.py:_init_db (existing peers → NULL).
+  owner TEXT
 );
 
 -- ─── THREADS — UUID ↔ readable thread name mapping ─────────────────

{swarph_cli-0.20.0 → swarph_cli-0.22.0}/src/swarph_cli/gateway/server.py

@@ -47,6 +47,7 @@ from datetime import datetime, timedelta, timezone
 from pathlib import Path
 from typing import Any, NamedTuple, Optional
 
+import jwt  # PyJWT — B1 Meta-Edge RS256 identity-token verification (gateway extra)
 from fastapi import FastAPI, Header, HTTPException, Query, Request
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import JSONResponse, Response
@@ -70,6 +71,14 @@ SCHEMA_PATH = os.environ.get(
 )
 PORT = int(os.environ.get("PORT", "8788"))
 
+# B1 Meta-Edge identity (META_EDGE_IDENTITY_CONTRACT.md). Meta-Edge SSO ISSUES
+# RS256 JWTs; the gateway only ever TRUSTS them with Meta-Edge's PUBLIC key (it
+# can never forge one — the identity↔relay asymmetry). All three are read at
+# CALL time (via os.environ, see _meta_edge_public_key) NOT cached at import, so
+# the key can be rotated without a restart and monkeypatched directly in tests.
+META_EDGE_ISSUER_DEFAULT = "meta-edge"
+META_EDGE_AUDIENCE_DEFAULT = "swarph-gateway"
+
 VALID_KINDS = {"status", "question", "answer", "unblock", "fyi"}
 VALID_COUNCIL_ROLES = {
     "r1_defender",          # Claude side (claude -p)
@@ -228,6 +237,25 @@ def _init_db() -> None:
         else:
             _grandfather_pending = False
 
+        # B2 migration (Meta-Edge login-scoped registry,
+        # META_EDGE_IDENTITY_CONTRACT.md). Add the nullable `owner` column to
+        # claude_peers for EXISTING DBs BEFORE schema.sql executescript (same
+        # probe+ALTER pattern as the ratification ALTER above). Additive and
+        # NULLABLE — existing/lab peers land owner=NULL and stay globally
+        # visible; only Meta-Edge-registered cells carry an owner. On a fresh
+        # install claude_peers doesn't exist yet — the OperationalError is
+        # caught and skipped (schema.sql's CREATE includes `owner` directly).
+        try:
+            c.execute("SELECT owner FROM claude_peers LIMIT 1")
+        except sqlite3.OperationalError as e:
+            if "no such column: owner" in str(e):
+                log.info("migrating DB: adding owner column to claude_peers (B2 login-scoped registry)")
+                c.execute("ALTER TABLE claude_peers ADD COLUMN owner TEXT")
+            # else: "no such table" = fresh install → schema.sql creates it with
+            # the column; any other OperationalError is a real fault → re-raise.
+            elif "no such table: claude_peers" not in str(e):
+                raise
+
         # v9 migration (R1 C3-A — trust-epoch stamp). Add binding_regime to
         # peer_ratifications BEFORE schema.sql executescript, mirroring the v3
         # ratification ALTER above. SQLite cannot add a CHECK constraint via
@@ -595,6 +623,79 @@ def _row_to_dict(row: Optional[sqlite3.Row]) -> Optional[dict]:
 # AUTH
 # =====================================================================
 
+def _meta_edge_public_key() -> Optional[str]:
+    """Return the configured Meta-Edge RS256 PUBLIC key PEM, or None if unset.
+
+    Read at CALL time (not cached at import) so the key can be rotated without a
+    restart and monkeypatched directly in tests. ``META_EDGE_PUBLIC_KEY`` (inline
+    PEM) takes precedence over ``META_EDGE_PUBLIC_KEY_FILE`` (path). A None return
+    means Meta-Edge verification is simply NOT enabled (the gateway runs in
+    lab-only mode); an unreadable key FILE also returns None (and logs) rather
+    than raising — the JWT branch is only entered when this returns a key.
+    """
+    pem = os.environ.get("META_EDGE_PUBLIC_KEY", "").strip()
+    if pem:
+        return pem
+    path = os.environ.get("META_EDGE_PUBLIC_KEY_FILE", "").strip()
+    if path:
+        try:
+            return Path(path).read_text().strip() or None
+        except OSError as e:
+            log.warning("META_EDGE_PUBLIC_KEY_FILE unreadable (%s); Meta-Edge auth disabled", e)
+            return None
+    return None
+
+
+def _looks_like_jwt(token: str) -> bool:
+    """A compact JWS/JWT is three non-empty '.'-separated base64url segments."""
+    parts = token.split(".")
+    return len(parts) == 3 and all(parts)
+
+
+def _verify_meta_edge_token(token: str) -> Optional[dict]:
+    """Verify a Meta-Edge RS256 identity/join JWT — FAIL-CLOSED (B1 security core).
+
+    Returns the verified claims dict on success, or None on ANY problem (the
+    gateway TRUSTS Meta-Edge's tokens but never partial-trusts). Returns None when
+    no Meta-Edge public key is configured (verification not enabled).
+
+    The algorithm is PINNED to RS256 explicitly (``algorithms=["RS256"]``) — this
+    single rule blocks BOTH ``alg:none`` (unsigned forgeries) AND the HS256
+    algorithm-confusion attack (a token HMAC-signed with the RSA *public* key
+    bytes as the shared secret). The token header NEVER picks the algorithm.
+    iss/aud/exp and the presence of exp/iss/aud/sub are all required and verified;
+    a 30s leeway absorbs clock skew only.
+    """
+    pem = _meta_edge_public_key()
+    if not pem:
+        return None
+    issuer = os.environ.get("META_EDGE_ISSUER", META_EDGE_ISSUER_DEFAULT)
+    audience = os.environ.get("META_EDGE_AUDIENCE", META_EDGE_AUDIENCE_DEFAULT)
+    try:
+        return jwt.decode(
+            token,
+            pem,
+            algorithms=["RS256"],
+            audience=audience,
+            issuer=issuer,
+            leeway=30,
+            options={
+                "require": ["exp", "iss", "aud", "sub"],
+                "verify_signature": True,
+                "verify_aud": True,
+                "verify_iss": True,
+                "verify_exp": True,
+            },
+        )
+    except Exception as e:
+        # Fail-closed on EVERYTHING: bad signature, alg mismatch (none/HS256),
+        # expired, wrong iss/aud, missing required claim, malformed token, or any
+        # unexpected error. A security verifier denies on doubt and never leaks
+        # which check failed to the caller (only logs server-side).
+        log.warning("Meta-Edge token rejected: %s: %s", type(e).__name__, e)
+        return None
+
+
 class AuthContext(NamedTuple):
     """Resolved identity of an authenticated caller (R1 C1).
 
@@ -614,10 +715,29 @@ class AuthContext(NamedTuple):
     C3-B (peer_ratify) and C2 (caller-binding) read it. Live behavior is
     unchanged: shared tokens authenticate exactly as before; per-peer resolution
     is additive and nothing enforces caller==peer yet.
+
+    B1/B2 (META_EDGE_IDENTITY_CONTRACT.md) adds a THIRD principal kind alongside
+    the two lab regimes, discriminated by ``kind`` (None for the lab regimes):
+      - kind='user_identity' : a verified Meta-Edge SSO login. user=<sub> (the
+                               canonical Meta-Edge user id / owner key),
+                               provider/login informational. Scopes GET /peers to
+                               owned cells; stamps owner=user on register.
+      - kind='cell_join'     : a verified Meta-Edge join-key (the `tailscale up
+                               --authkey` analog). owner=<owner claim>; a
+                               one-purpose registration credential — stamps
+                               owner on register, grants nothing else.
+    All NamedTuple fields carry defaults so the two existing keyword call sites
+    (shared_token / per_peer_token) are untouched and the identity branches
+    construct with only their own fields.
     """
-    peer: Optional[str]
-    regime: str
-    key_generation: Optional[int]
+    peer: Optional[str] = None
+    regime: str = "shared_token"
+    key_generation: Optional[int] = None
+    kind: Optional[str] = None
+    user: Optional[str] = None
+    provider: Optional[str] = None
+    login: Optional[str] = None
+    owner: Optional[str] = None
 
 
 def _is_revoked(c, peer, key_generation) -> bool:
@@ -647,6 +767,40 @@ def _authorize(authorization: Optional[str]) -> AuthContext:
     if not authorization or not authorization.startswith("Bearer "):
         raise HTTPException(401, "missing bearer token")
     token = authorization.removeprefix("Bearer ").strip()
+    # 0. Meta-Edge identity branch (B1/B2) — FIRST, and FAIL-CLOSED with NO
+    #    fall-through. If the bearer is JWT-shaped AND a Meta-Edge public key is
+    #    configured, it MUST be a valid Meta-Edge token: verification failure
+    #    raises 401 here and is NEVER re-interpreted against the shared/peer-token
+    #    paths (re-interpreting a forged/expired JWT would be a downgrade attack).
+    #    Non-JWT bearers (the lab's opaque tokens) skip this branch untouched.
+    if _looks_like_jwt(token) and _meta_edge_public_key():
+        claims = _verify_meta_edge_token(token)
+        if claims is None:
+            raise HTTPException(401, "invalid Meta-Edge token")
+        purpose = claims.get("purpose")
+        if purpose in (None, "identity"):
+            # Verified SSO login → read + owner-scope. sub is the canonical
+            # Meta-Edge user id (the owner key); provider/login are informational.
+            return AuthContext(
+                kind="user_identity",
+                user=claims.get("sub"),
+                provider=claims.get("provider"),
+                login=claims.get("login"),
+            )
+        if purpose == "cell-join":
+            # A one-purpose join-key (tailscale up --authkey analog). It MUST
+            # carry the owner it registers the cell under — a join-key without an
+            # owner claim is fail-closed (it would otherwise register an
+            # unowned/lab-visible cell, defeating the scoping it exists for).
+            owner = claims.get("owner")
+            if not owner:
+                log.warning("Meta-Edge cell-join token missing owner claim; rejected")
+                raise HTTPException(401, "invalid Meta-Edge token")
+            return AuthContext(kind="cell_join", owner=owner)
+        # A validly-signed token with an UNRECOGNIZED purpose is fail-closed —
+        # never default an unknown purpose into the privileged identity path.
+        log.warning("Meta-Edge token with unrecognized purpose=%r rejected", purpose)
+        raise HTTPException(401, "invalid Meta-Edge token")
     # 1. Shared-token branch FIRST — verbatim from pre-C1, constant-time
     #    compare_digest preserved, and resolved before any DB hit so the common
     #    path takes no extra latency. Shared tokens carry no peer identity.
@@ -875,7 +1029,19 @@ async def peers_register(req: PeerRegisterRequest,
     Called from each peer's systemd ExecStartPost or on-demand. Upserts on
     name. capabilities dict is the JSON snapshot from claude-service /health.
     """
-    _authorize(authorization)
+    ctx = _authorize(authorization)
+    # B2 owner-stamping (META_EDGE_IDENTITY_CONTRACT.md §Cell-join). A Meta-Edge
+    # principal ties the registered cell to its owner (the node-in-your-tailnet
+    # relationship); lab principals (shared/commander/per-peer token) leave owner
+    # NULL — unchanged behavior:
+    #   - cell_join     → owner = the join-key's owner claim (headless join).
+    #   - user_identity → owner = the verified user `sub` (interactive join: the
+    #                     user's app registers the cell on their behalf).
+    owner: Optional[str] = None
+    if ctx.kind == "cell_join":
+        owner = ctx.owner
+    elif ctx.kind == "user_identity":
+        owner = ctx.user
     now = _utcnow_iso()
     # R1 C1: mint-once per-peer token. Set only when a fresh token is minted
     # on this call; a re-register of a peer whose LIVE token still exists returns
@@ -899,13 +1065,17 @@ async def peers_register(req: PeerRegisterRequest,
         try:
             c.execute(
                 """INSERT INTO claude_peers
-                     (name, url, capabilities, registered_at, last_seen, ratified)
-                   VALUES (?, ?, ?, ?, ?, 0)
+                     (name, url, capabilities, registered_at, last_seen, ratified, owner)
+                   VALUES (?, ?, ?, ?, ?, 0, ?)
                    ON CONFLICT(name) DO UPDATE SET
                      url = excluded.url,
                      capabilities = excluded.capabilities,
-                     last_seen = excluded.last_seen""",
-                (req.name, req.url, json.dumps(req.capabilities), now, now),
+                     last_seen = excluded.last_seen,
+                     -- B2: a Meta-Edge register stamps/refreshes owner; a lab
+                     -- (owner-NULL) re-register PRESERVES an existing owner via
+                     -- COALESCE rather than clobbering it back to NULL.
+                     owner = COALESCE(excluded.owner, claude_peers.owner)""",
+                (req.name, req.url, json.dumps(req.capabilities), now, now, owner),
             )
             # R1 C4: mint-once becomes mint-or-rotate-past-a-revocation.
             #   - NO token row          → C1's gen=1 mint (first onboarding).
@@ -980,14 +1150,25 @@ async def peers_register(req: PeerRegisterRequest,
 @app.get("/peers")
 async def peers_list(authorization: Optional[str] = Header(None),
                       enabled_only: bool = Query(True)) -> dict:
-    _authorize(authorization)
-    where = "WHERE enabled = 1" if enabled_only else ""
+    ctx = _authorize(authorization)
+    clauses: list[str] = []
+    params: list = []
+    if enabled_only:
+        clauses.append("enabled = 1")
+    # B2 login-scoping: a Meta-Edge user_identity sees ONLY its OWN cells
+    # (owner == sub). Every other principal (shared/commander/per-peer token —
+    # the lab paths) is UNCHANGED and still sees all peers.
+    if ctx.kind == "user_identity":
+        clauses.append("owner = ?")
+        params.append(ctx.user)
+    where = ("WHERE " + " AND ".join(clauses)) if clauses else ""
     with _conn() as c:
         rows = c.execute(
             f"SELECT name, url, capabilities, registered_at, last_health, "
             f"last_seen, enabled, ratified, ratified_at, ratified_by, "
-            f"ratification_reason "
-            f"FROM claude_peers {where} ORDER BY name"
+            f"ratification_reason, owner "
+            f"FROM claude_peers {where} ORDER BY name",
+            params,
         ).fetchall()
     return {
         "peers": [

{swarph_cli-0.20.0 → swarph_cli-0.22.0/src/swarph_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: swarph-cli
-Version: 0.20.0
+Version: 0.22.0
 Summary: The `swarph` binary — a multi-LLM CLI and mesh-gateway client + bundled server (`swarph gateway`): one-shot prompts across providers, interactive `chat`, multi-provider `spawn` (claude/codex/antigravity via a ProviderMembrane with subprocess billing-scrub), `mesh` send/inbox/register, `brain-ask` over the swarph-brain (gbrain) semantic memory, git-backed `assisted_memory`, session `import`, and a stranded-session `watchdog`.
 Author: Pierre Samson, Claude Opus
 License: MIT
@@ -36,6 +36,7 @@ Requires-Dist: fastapi>=0.115; extra == "gateway"
 Requires-Dist: uvicorn[standard]>=0.32; extra == "gateway"
 Requires-Dist: pydantic>=2.9; extra == "gateway"
 Requires-Dist: croniter>=6.2; extra == "gateway"
+Requires-Dist: PyJWT[crypto]>=2.8; extra == "gateway"
 Provides-Extra: service
 Requires-Dist: fastapi>=0.115; extra == "service"
 Requires-Dist: uvicorn[standard]>=0.32; extra == "service"

{swarph_cli-0.20.0 → swarph_cli-0.22.0}/src/swarph_cli.egg-info/SOURCES.txt

@@ -117,6 +117,7 @@ tests/test_mcp_server.py
 tests/test_memory_sync.py
 tests/test_mesh_command.py
 tests/test_mesh_sidecar.py
+tests/test_meta_edge_identity.py
 tests/test_multiplexer.py
 tests/test_onboard_command.py
 tests/test_protocol_handler.py

{swarph_cli-0.20.0 → swarph_cli-0.22.0}/src/swarph_cli.egg-info/requires.txt

@@ -10,6 +10,7 @@ fastapi>=0.115
 uvicorn[standard]>=0.32
 pydantic>=2.9
 croniter>=6.2
+PyJWT[crypto]>=2.8
 
 [mcp]
 mcp>=1.0

{swarph_cli-0.20.0 → swarph_cli-0.22.0}/tests/test_caller_meta_guard.py

@@ -119,7 +119,7 @@ def test_no_modules_skipped_by_the_walk():
             # so it is always walked.)
             if (mod.name.startswith(("swarph_cli.gateway", "swarph_cli.service.app"))
                     and isinstance(e, ModuleNotFoundError)
-                    and getattr(e, "name", None) in ("fastapi", "uvicorn", "pydantic")):
+                    and getattr(e, "name", None) in ("fastapi", "uvicorn", "pydantic", "jwt")):
                 continue
             skipped.append((mod.name, repr(e)))
     assert not skipped, (