swarph-cli 0.25.0__tar.gz → 0.26.0__tar.gz

{swarph_cli-0.25.0/src/swarph_cli.egg-info → swarph_cli-0.26.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: swarph-cli
-Version: 0.25.0
+Version: 0.26.0
 Summary: The `swarph` binary — a multi-LLM CLI and mesh-gateway client + bundled server (`swarph gateway`): one-shot prompts across providers, interactive `chat`, multi-provider `spawn` (claude/codex/antigravity via a ProviderMembrane with subprocess billing-scrub), `mesh` send/inbox/register, `brain-ask` over the swarph-brain (gbrain) semantic memory, git-backed `assisted_memory`, session `import`, and a stranded-session `watchdog`.
 Author: Pierre Samson, Claude Opus
 License: MIT

{swarph_cli-0.25.0 → swarph_cli-0.26.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "swarph-cli"
-version = "0.25.0"
+version = "0.26.0"
 description = "The `swarph` binary — a multi-LLM CLI and mesh-gateway client + bundled server (`swarph gateway`): one-shot prompts across providers, interactive `chat`, multi-provider `spawn` (claude/codex/antigravity via a ProviderMembrane with subprocess billing-scrub), `mesh` send/inbox/register, `brain-ask` over the swarph-brain (gbrain) semantic memory, git-backed `assisted_memory`, session `import`, and a stranded-session `watchdog`."
 readme = "README.md"
 license = { text = "MIT" }

{swarph_cli-0.25.0 → swarph_cli-0.26.0}/src/swarph_cli/__init__.py

@@ -16,6 +16,6 @@ The architecture splits CLI from substrate so:
 
 from __future__ import annotations
 
-__version__ = "0.25.0"
+__version__ = "0.26.0"
 
 __all__ = ["__version__"]

{swarph_cli-0.25.0 → swarph_cli-0.26.0}/src/swarph_cli/commands/brain_ask.py

@@ -15,6 +15,9 @@ Stdlib-only. Config from the environment, mirroring ``swarph mesh``'s token mode
     / SWARPH_BRAIN_TOKEN  mesh per-peer token (~/.config/swarph/<self>.peer_token).
     / peer-token file     Once gbrain accepts mesh peer tokens, the peer token IS
                           the read token — no separate secret to provision.
+  SWARPH_BRAIN_GATEWAY  when set, query the brain via the mesh gateway's
+                        /brain/query proxy using the cell's mesh peer token
+                        (no per-cell gbrain_ token). Unset = direct :8792.
   SWARPH_FACADE         optional synthesis endpoint (claude-service chat-completions)
   SWARPH_FACADE_TOKEN   bearer for the facade
 """
@@ -127,6 +130,15 @@ def _mcp_query(url: str, token: str, question: str, limit: int) -> list:
     return _parse_query_response(raw)
 
 
+def _gateway_query(gw_base: str, peer_token: str, question: str, limit: int) -> list:
+    """Query the brain via the mesh gateway's /brain/query proxy, authenticating
+    with the cell's MESH peer token. The gateway holds the gbrain token; we never do."""
+    url = gw_base.rstrip("/") + "/brain/query"
+    raw = _http_post(url, {"query": question, "limit": limit}, peer_token,
+                     accept="application/json")
+    return json.loads(raw).get("chunks", [])
+
+
 def _synthesize(facade_url: str, facade_token: str, question: str, chunks: list) -> str:
     """Ask the $0 facade to answer ONLY from the retrieved chunks, citing slugs."""
     context = _format_chunks(chunks)
@@ -158,19 +170,36 @@ def run_brain_ask(argv: list) -> int:
     args = parser.parse_args(argv)
     question = " ".join(args.question)
 
-    token = _resolve_token(args.token_file, _self_name())
-    if not token:
-        sys.stderr.write(
-            "swarph brain-ask: no gbrain read token "
-            "(set GBRAIN_TOKEN / SWARPH_BRAIN_TOKEN, pass --token-file, or place a "
-            "mesh peer token at ~/.config/swarph/<self>.peer_token)\n")
-        return 2
-
-    try:
-        chunks = _mcp_query(args.gateway, token, question, args.limit)
-    except Exception as exc:  # noqa: BLE001 — surface any transport/parse failure cleanly
-        sys.stderr.write(f"swarph brain-ask: gbrain query failed: {exc}\n")
-        return 1
+    gw = os.environ.get("SWARPH_BRAIN_GATEWAY")
+    if gw:
+        self_name = _self_name()
+        try:
+            peer_token = _peer_token_path(self_name).read_text(encoding="utf-8").strip()
+        except OSError:
+            peer_token = ""
+        if not peer_token:
+            sys.stderr.write(
+                f"swarph brain-ask: SWARPH_BRAIN_GATEWAY set but no mesh peer token at "
+                f"~/.config/swarph/{self_name}.peer_token\n")
+            return 2
+        try:
+            chunks = _gateway_query(gw, peer_token, question, args.limit)
+        except Exception as e:  # noqa: BLE001 — surface, don't swallow
+            sys.stderr.write(f"swarph brain-ask: gateway brain query failed: {e}\n")
+            return 1
+    else:
+        token = _resolve_token(args.token_file, _self_name())
+        if not token:
+            sys.stderr.write(
+                "swarph brain-ask: no gbrain read token "
+                "(set GBRAIN_TOKEN / SWARPH_BRAIN_TOKEN, pass --token-file, or place a "
+                "mesh peer token at ~/.config/swarph/<self>.peer_token)\n")
+            return 2
+        try:
+            chunks = _mcp_query(args.gateway, token, question, args.limit)
+        except Exception as exc:  # noqa: BLE001 — surface any transport/parse failure cleanly
+            sys.stderr.write(f"swarph brain-ask: gbrain query failed: {exc}\n")
+            return 1
 
     facade = os.environ.get("SWARPH_FACADE")
     if args.no_synth or not facade:

{swarph_cli-0.25.0 → swarph_cli-0.26.0}/src/swarph_cli/gateway/server.py

@@ -41,6 +41,7 @@ import sqlite3
 import sys
 import time
 import unicodedata
+import urllib.request
 import uuid
 from contextlib import contextmanager
 from datetime import datetime, timedelta, timezone
@@ -52,6 +53,7 @@ from fastapi import FastAPI, Header, HTTPException, Query, Request
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import JSONResponse, Response
 from pydantic import BaseModel, Field
+from starlette.concurrency import run_in_threadpool
 
 from .feature_registry import aggregate_features, apply_allowlist, apply_caps
 
@@ -71,6 +73,12 @@ SCHEMA_PATH = os.environ.get(
 )
 PORT = int(os.environ.get("PORT", "8788"))
 
+# Gateway-held gbrain proxy token (POST /brain/query). Cells authenticate to
+# THIS gateway with their mesh token; the gateway then presents ITS OWN
+# gbrain token upstream so cells never need a separate gbrain_ credential.
+GATEWAY_GBRAIN_URL = os.environ.get("GATEWAY_GBRAIN_URL", "http://100.107.222.72:8792/mcp")
+GATEWAY_GBRAIN_TOKEN = os.environ.get("GATEWAY_GBRAIN_TOKEN", "")
+
 # B1 Meta-Edge identity (META_EDGE_IDENTITY_CONTRACT.md). Meta-Edge SSO ISSUES
 # RS256 JWTs; the gateway only ever TRUSTS them with Meta-Edge's PUBLIC key (it
 # can never forge one — the identity↔relay asymmetry). All three are read at
@@ -4196,6 +4204,59 @@ async def council_reclaim_stuck(req: CouncilReclaimStuckRequest,
     }
 
 
+# =====================================================================
+# BRAIN PROXY (POST /brain/query)
+# =====================================================================
+
+def _brain_query_upstream(question: str, limit: int) -> list:
+    """Proxy a READ-ONLY gbrain query. Builds the MCP `query` call itself (never
+    write/admin), POSTs to GATEWAY_GBRAIN_URL with the gateway-held token, returns
+    the chunk array. Raises on any upstream/parse failure (caller maps to 502)."""
+    body = {"jsonrpc": "2.0", "id": 1, "method": "tools/call",
+            "params": {"name": "query",
+                       "arguments": {"query": question, "limit": limit, "expand": False}}}
+    req = urllib.request.Request(
+        GATEWAY_GBRAIN_URL, data=json.dumps(body).encode("utf-8"), method="POST")
+    req.add_header("Content-Type", "application/json")
+    req.add_header("Accept", "application/json, text/event-stream")
+    req.add_header("Authorization", f"Bearer {GATEWAY_GBRAIN_TOKEN}")
+    with urllib.request.urlopen(req, timeout=30) as resp:  # noqa: S310 — fixed tailnet URL
+        raw = resp.read().decode("utf-8")
+    payload = raw
+    if "data:" in raw:
+        for line in raw.splitlines():
+            s = line.strip()
+            if s.startswith("data:"):
+                payload = s[len("data:"):].strip()
+                break
+    doc = json.loads(payload)
+    parsed = json.loads(doc["result"]["content"][0]["text"])
+    return parsed if isinstance(parsed, list) else []
+
+
+class BrainQueryRequest(BaseModel):
+    query: str
+    limit: int = 8
+
+
+@app.post("/brain/query")
+async def brain_query(req: BrainQueryRequest,
+                      authorization: Optional[str] = Header(None)) -> dict:
+    auth = _authorize(authorization)                      # 401 on bad mesh token
+    if not GATEWAY_GBRAIN_TOKEN:
+        raise HTTPException(503, "brain proxy not configured")
+    if not req.query.strip():
+        raise HTTPException(400, "query is required")
+    try:
+        chunks = await run_in_threadpool(_brain_query_upstream, req.query, req.limit)
+    except Exception as e:  # fail loud — never a swallowed empty result
+        log.warning("brain proxy upstream error for peer=%s: %s", auth.peer, e)
+        raise HTTPException(502, "brain upstream error")
+    log.info("brain query peer=%s regime=%s limit=%d chunks=%d",
+             auth.peer, auth.regime, req.limit, len(chunks))
+    return {"chunks": chunks}
+
+
 # =====================================================================
 # STARTUP
 # =====================================================================

{swarph_cli-0.25.0 → swarph_cli-0.26.0/src/swarph_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: swarph-cli
-Version: 0.25.0
+Version: 0.26.0
 Summary: The `swarph` binary — a multi-LLM CLI and mesh-gateway client + bundled server (`swarph gateway`): one-shot prompts across providers, interactive `chat`, multi-provider `spawn` (claude/codex/antigravity via a ProviderMembrane with subprocess billing-scrub), `mesh` send/inbox/register, `brain-ask` over the swarph-brain (gbrain) semantic memory, git-backed `assisted_memory`, session `import`, and a stranded-session `watchdog`.
 Author: Pierre Samson, Claude Opus
 License: MIT

{swarph_cli-0.25.0 → swarph_cli-0.26.0}/src/swarph_cli.egg-info/SOURCES.txt

@@ -105,6 +105,7 @@ tests/test_compress_verify.py
 tests/test_daemon_command.py
 tests/test_event_emit.py
 tests/test_feature_to_uri.py
+tests/test_gateway_brain.py
 tests/test_gateway_client.py
 tests/test_gateway_command.py
 tests/test_highlight_command.py

{swarph_cli-0.25.0 → swarph_cli-0.26.0}/tests/test_brain_ask_command.py

@@ -13,6 +13,13 @@ from unittest.mock import patch
 from swarph_cli.commands import brain_ask as ba
 
 
+# --- version ---------------------------------------------------------------
+
+def test_version_is_0_26_0():
+    import swarph_cli
+    assert swarph_cli.__version__ == "0.26.0"
+
+
 # --- request / response plumbing -------------------------------------------
 
 def test_build_query_request_shape():
@@ -122,3 +129,55 @@ def test_resolve_endpoint_default_is_localhost(monkeypatch):
     monkeypatch.delenv("GBRAIN_MCP_URL", raising=False)
     monkeypatch.delenv("SWARPH_BRAIN_MCP", raising=False)
     assert ba._resolve_endpoint() == "http://127.0.0.1:8792/mcp"
+
+
+# --- SWARPH_BRAIN_GATEWAY client path (Task 2) ------------------------------
+
+def test_gateway_query_posts_brain_query_with_peer_token(monkeypatch, tmp_path):
+    from swarph_cli.commands import brain_ask
+    captured = {}
+    def fake_http_post(url, body, token, accept="application/json, text/event-stream", timeout=30):
+        captured.update(url=url, body=body, token=token)
+        import json as _j
+        return _j.dumps({"chunks": [{"slug": "s1", "chunk_text": "x"}]})
+    monkeypatch.setattr(brain_ask, "_http_post", fake_http_post)
+    out = brain_ask._gateway_query("http://gw:8788", "peer_tok_123", "hello", 5)
+    assert out == [{"slug": "s1", "chunk_text": "x"}]
+    assert captured["url"] == "http://gw:8788/brain/query"
+    assert captured["body"] == {"query": "hello", "limit": 5}
+    assert captured["token"] == "peer_tok_123"
+
+
+def test_run_brain_ask_uses_gateway_when_env_set(monkeypatch, tmp_path, capsys):
+    from swarph_cli.commands import brain_ask
+    # peer token on disk for _self_name()
+    cfg = tmp_path / ".config" / "swarph"
+    cfg.mkdir(parents=True)
+    (cfg / "wlc.peer_token").write_text("peer_tok_xyz", encoding="utf-8")
+    monkeypatch.setattr(brain_ask.Path, "home", classmethod(lambda cls: tmp_path))
+    monkeypatch.setenv("SWARPH_SELF", "wlc")
+    monkeypatch.setenv("SWARPH_BRAIN_GATEWAY", "http://gw:8788")
+    seen = {}
+    def fake_gateway_query(gw, tok, q, n):
+        seen.update(gw=gw, tok=tok, q=q)
+        return [{"slug": "s1", "chunk_text": "hit"}]
+    monkeypatch.setattr(brain_ask, "_gateway_query", fake_gateway_query)
+    rc = brain_ask.run_brain_ask(["--no-synth", "what", "is", "up"])
+    assert rc == 0
+    assert seen["gw"] == "http://gw:8788" and seen["tok"] == "peer_tok_xyz"
+    assert "s1" in capsys.readouterr().out
+
+
+def test_run_brain_ask_direct_path_unchanged_when_gateway_unset(monkeypatch, capsys):
+    from swarph_cli.commands import brain_ask
+    monkeypatch.delenv("SWARPH_BRAIN_GATEWAY", raising=False)
+    monkeypatch.setenv("GBRAIN_TOKEN", "gbrain_direct")
+    called = {}
+    def fake_mcp(url, tok, q, n):
+        called["hit"] = (url, tok)
+        return [{"slug": "d"}]
+    monkeypatch.setattr(brain_ask, "_mcp_query", fake_mcp)
+    rc = brain_ask.run_brain_ask(["--no-synth", "hello"])
+    assert rc == 0
+    assert called["hit"][1] == "gbrain_direct"     # direct path used the gbrain token
+    assert "d" in capsys.readouterr().out

swarph_cli-0.26.0/tests/test_gateway_brain.py

@@ -0,0 +1,104 @@
+import json
+import os
+import importlib
+import tempfile
+import pytest
+from types import SimpleNamespace
+
+# The gateway server stack is an optional extra ([gateway]); its module top
+# does `import jwt` (PyJWT) + fastapi. Skip the whole file when those aren't
+# installed (e.g. Windows CI, which doesn't install the gateway extra) — same
+# guard the sibling gateway test tests/test_meta_edge_identity.py uses.
+pytest.importorskip("fastapi")
+pytest.importorskip("jwt")
+
+
+def _load_app(monkeypatch, *, gbrain_token="gbrain_hostheld", auth="tok_shared"):
+    monkeypatch.setenv("MESH_GATEWAY_TOKEN", auth)
+    monkeypatch.setenv("GATEWAY_GBRAIN_TOKEN", gbrain_token)
+    monkeypatch.setenv("GATEWAY_GBRAIN_URL", "http://127.0.0.1:8792/mcp")
+    # NOTE: ":memory:" (as written in the task brief) is incompatible with this
+    # module's _conn()/_init_db(), which open a FRESH sqlite3.connect() per call
+    # with no shared cache — each ":memory:" connection is an independent,
+    # isolated DB, so the schema built by _init_db()'s first connection is gone
+    # by its second. That fails at import time, before any endpoint code runs,
+    # for every one of the 6 tests here — not the brief's expected 404/
+    # AttributeError RED. Using a real temp-file path (matching the existing
+    # pattern in tests/test_meta_edge_identity.py) fixes the scaffold without
+    # touching production DB code, and restores the brief's intended RED.
+    monkeypatch.setenv("MESH_DB_PATH", os.path.join(tempfile.mkdtemp(), "mesh.db"))
+    from swarph_cli.gateway import server
+    importlib.reload(server)          # re-read module-top env config
+    return server
+
+
+def _sse(chunks):
+    inner = json.dumps(chunks)
+    env = {"jsonrpc": "2.0", "id": 1, "result": {"content": [{"type": "text", "text": inner}]}}
+    return "event: message\ndata: " + json.dumps(env) + "\n\n"
+
+
+def _client(server):
+    from fastapi.testclient import TestClient
+    return TestClient(server.app)
+
+
+def test_brain_query_authenticates_and_returns_chunks(monkeypatch):
+    server = _load_app(monkeypatch)
+    chunks = [{"slug": "s1", "title": "T", "chunk_text": "hello", "score": 0.9}]
+    monkeypatch.setattr(server, "_brain_query_upstream", lambda q, n: chunks)
+    r = _client(server).post("/brain/query", json={"query": "hi", "limit": 5},
+                             headers={"Authorization": "Bearer tok_shared"})
+    assert r.status_code == 200
+    assert r.json() == {"chunks": chunks}
+
+
+def test_brain_query_bad_token_401(monkeypatch):
+    server = _load_app(monkeypatch)
+    monkeypatch.setattr(server, "_brain_query_upstream", lambda q, n: [])
+    r = _client(server).post("/brain/query", json={"query": "hi"},
+                             headers={"Authorization": "Bearer wrong"})
+    assert r.status_code == 401
+
+
+def test_brain_query_unconfigured_503(monkeypatch):
+    server = _load_app(monkeypatch, gbrain_token="")   # GATEWAY_GBRAIN_TOKEN unset
+    r = _client(server).post("/brain/query", json={"query": "hi"},
+                             headers={"Authorization": "Bearer tok_shared"})
+    assert r.status_code == 503
+
+
+def test_brain_query_empty_query_400(monkeypatch):
+    server = _load_app(monkeypatch)
+    monkeypatch.setattr(server, "_brain_query_upstream", lambda q, n: [])
+    r = _client(server).post("/brain/query", json={"query": "   "},
+                             headers={"Authorization": "Bearer tok_shared"})
+    assert r.status_code == 400
+
+
+def test_brain_query_upstream_error_502(monkeypatch):
+    server = _load_app(monkeypatch)
+    def boom(q, n): raise RuntimeError("gbrain down")
+    monkeypatch.setattr(server, "_brain_query_upstream", boom)
+    r = _client(server).post("/brain/query", json={"query": "hi"},
+                             headers={"Authorization": "Bearer tok_shared"})
+    assert r.status_code == 502
+
+
+def test_upstream_helper_is_read_only_by_construction(monkeypatch):
+    """The MCP body the proxy sends upstream ALWAYS has params.name == 'query'."""
+    server = _load_app(monkeypatch)
+    captured = {}
+    class FakeResp:
+        def read(self): return _sse([{"slug": "s"}]).encode()
+        def __enter__(self): return self
+        def __exit__(self, *a): return False
+    def fake_urlopen(req, timeout=None):
+        captured["body"] = json.loads(req.data.decode())
+        captured["auth"] = req.get_header("Authorization")
+        return FakeResp()
+    monkeypatch.setattr(server.urllib.request, "urlopen", fake_urlopen)
+    out = server._brain_query_upstream("anything", 8)
+    assert out == [{"slug": "s"}]
+    assert captured["body"]["params"]["name"] == "query"          # read-only lock
+    assert captured["auth"] == "Bearer gbrain_hostheld"           # gateway's held token

{swarph_cli-0.25.0 → swarph_cli-0.26.0}/tests/test_watchdog.py

@@ -1041,6 +1041,6 @@ def test_parser_defaults_process_name_claude_liveness_cmd_none():
     assert ns.liveness_cmd is None
 
 
-def test_version_is_0_25_0():
+def test_version_is_0_26_0():
     import swarph_cli
-    assert swarph_cli.__version__ == "0.25.0"
+    assert swarph_cli.__version__ == "0.26.0"