swarph-cli 0.40.2__tar.gz → 0.40.3__tar.gz

{swarph_cli-0.40.2/src/swarph_cli.egg-info → swarph_cli-0.40.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: swarph-cli
-Version: 0.40.2
+Version: 0.40.3
 Summary: The `swarph` binary — a multi-LLM CLI and mesh-gateway client + bundled server (`swarph gateway`): one-shot prompts across providers, interactive `chat`, multi-provider `spawn` (claude/codex/antigravity via a ProviderMembrane with subprocess billing-scrub), `mesh` send/inbox/register, `brain-ask` over the swarph-brain (gbrain) semantic memory, git-backed `assisted_memory`, session `import`, and a stranded-session `watchdog`.
 Author: Pierre Samson, Claude Opus
 License: MIT

{swarph_cli-0.40.2 → swarph_cli-0.40.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "swarph-cli"
-version = "0.40.2"
+version = "0.40.3"
 description = "The `swarph` binary — a multi-LLM CLI and mesh-gateway client + bundled server (`swarph gateway`): one-shot prompts across providers, interactive `chat`, multi-provider `spawn` (claude/codex/antigravity via a ProviderMembrane with subprocess billing-scrub), `mesh` send/inbox/register, `brain-ask` over the swarph-brain (gbrain) semantic memory, git-backed `assisted_memory`, session `import`, and a stranded-session `watchdog`."
 readme = "README.md"
 license = { text = "MIT" }

{swarph_cli-0.40.2 → swarph_cli-0.40.3}/src/swarph_cli/__init__.py

@@ -16,6 +16,6 @@ The architecture splits CLI from substrate so:
 
 from __future__ import annotations
 
-__version__ = "0.40.2"
+__version__ = "0.40.3"
 
 __all__ = ["__version__"]

{swarph_cli-0.40.2 → swarph_cli-0.40.3}/src/swarph_cli/commands/schedule.py

@@ -40,7 +40,13 @@ def _build_parser() -> argparse.ArgumentParser:
         "--context",
         action="append",
         default=[],
-        help="context reference (repeatable)",
+        metavar="KEY=VALUE",
+        help="durable context anchor, repeatable. KEY is one of "
+             + "|".join(sorted(DURABLE_ANCHOR_KEYS))
+             + " (e.g. --context memory=project_x --context repo=swarph-cli). "
+             "A raw JSON object is also accepted. REQUIRED: the gateway rejects an "
+             "event with no anchors, because an event that fires with no durable "
+             "context wakes a cell that cannot reconstruct why.",
     )
     create.add_argument(
         "--min-interval",
@@ -93,14 +99,81 @@ def _ctx(args: argparse.Namespace) -> tuple[str, str, str]:
     return self_name, token, base
 
 
+
+# Mirrors mesh-gateway `_DURABLE_ANCHOR_KEYS` (server.py). Kept in sync by
+# test_schedule_create_contract.py, which fails if this drifts from the value the
+# gateway actually enforces — a duplicated constant nobody checks is how the two
+# sides diverged in the first place.
+DURABLE_ANCHOR_KEYS = frozenset({"repo", "memory", "channel", "feature", "file"})
+
+
+def parse_context_anchor(raw: str) -> dict:
+    """Turn one --context value into the ANCHOR DICT the gateway requires.
+
+    >>> THE BUG THIS FIXES (card #146): the CLI sent `--context` values through as
+        RAW STRINGS while the gateway requires each anchor to be a DICT carrying a
+        durable key, and requires the list to be NON-EMPTY. So `swarph schedule
+        create` COULD NOT SUCCEED — every invocation 400'd, and every real event on
+        this mesh had to be armed by hand over the raw API. <<<
+
+    That is why dated reminders kept living in DM threads instead of the scheduler:
+    the verb that makes a date fire was itself broken, so the cheapest path was
+    always to tell a peer and hope.
+
+    Accepts `key=value` for the five durable kinds, or a raw JSON object for
+    anything the shorthand cannot express. Raises ValueError with the valid keys
+    listed, LOCALLY — a 400 from the gateway names the rule but not the input that
+    broke it, and the user is holding the input.
+    """
+    raw = (raw or "").strip()
+    if not raw:
+        raise ValueError("empty --context value")
+    if raw.startswith("{"):
+        try:
+            anchor = json.loads(raw)
+        except json.JSONDecodeError as exc:
+            raise ValueError(f"--context {raw!r} looks like JSON but does not parse: {exc}") from exc
+        if not isinstance(anchor, dict):
+            raise ValueError(f"--context JSON must be an object, got {type(anchor).__name__}")
+        if not (set(anchor) & DURABLE_ANCHOR_KEYS):
+            raise ValueError(
+                f"--context {raw!r} has no durable key; one of "
+                f"{sorted(DURABLE_ANCHOR_KEYS)} is required")
+        return anchor
+    key, sep, value = raw.partition("=")
+    key, value = key.strip(), value.strip()
+    if not sep or not value:
+        raise ValueError(
+            f"--context {raw!r} must be KEY=VALUE (e.g. memory=project_x); "
+            f"KEY is one of {sorted(DURABLE_ANCHOR_KEYS)}")
+    if key not in DURABLE_ANCHOR_KEYS:
+        raise ValueError(
+            f"--context key {key!r} is not durable; use one of {sorted(DURABLE_ANCHOR_KEYS)}. "
+            f"An anchor must name something that survives compaction — a /tmp path or a "
+            f"session id is exactly what the gateway rejects.")
+    return {key: value}
+
+
 def _run_create(args: argparse.Namespace) -> int:
     self_name, token, base = _ctx(args)
+    if not args.context:
+        print("swarph schedule create: --context is REQUIRED (repeatable).\n"
+              "  The gateway refuses an event with no durable anchor: an event that\n"
+              "  fires with no context wakes a cell that cannot reconstruct why it woke.\n"
+              f"  Use KEY=VALUE with KEY in {sorted(DURABLE_ANCHOR_KEYS)},\n"
+              "  e.g. --context memory=project_graduation_register", file=sys.stderr)
+        return 2
+    try:
+        anchors = [parse_context_anchor(c) for c in args.context]
+    except ValueError as exc:
+        print(f"swarph schedule create: {exc}", file=sys.stderr)
+        return 2
     body = {
         "name": args.name,
         "trigger_type": args.trigger,
         "target_cell": args.target,
         "task": args.task,
-        "context_ref": args.context,
+        "context_ref": anchors,
         "created_by": self_name,
     }
     if args.cron is not None:

{swarph_cli-0.40.2 → swarph_cli-0.40.3}/src/swarph_cli/gateway/server.py

@@ -2437,8 +2437,15 @@ def _is_operator(auth: AuthContext) -> bool:
     membership/broadcast authority of the FUTURE POST surface is likewise REAL
     only post-C5 (a cell can already create an announce channel + own
     allow_broadcast=1 on it). Mitigation now: pre-seed the reserved names via the
-    operator at deploy so the PK-409 protects the canonical names meanwhile."""
-    return auth.peer is None
+    operator at deploy so the PK-409 protects the canonical names meanwhile.
+
+    META-EDGE (B1/B2): a verified SSO login (kind='user_identity') and a
+    cell-join key (kind='cell_join') BOTH carry peer=None, so a bare
+    `peer is None` check made every OAuth login a full operator — an
+    OAuth-driven operator factory. The genuine operator is the shared/commander
+    token ALONE, which is the only context with BOTH peer=None AND kind=None.
+    A Meta-Edge context is owner-scoped, never operator."""
+    return auth.peer is None and auth.kind is None
 
 
 class ChannelCreateRequest(BaseModel):

{swarph_cli-0.40.2 → swarph_cli-0.40.3/src/swarph_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: swarph-cli
-Version: 0.40.2
+Version: 0.40.3
 Summary: The `swarph` binary — a multi-LLM CLI and mesh-gateway client + bundled server (`swarph gateway`): one-shot prompts across providers, interactive `chat`, multi-provider `spawn` (claude/codex/antigravity via a ProviderMembrane with subprocess billing-scrub), `mesh` send/inbox/register, `brain-ask` over the swarph-brain (gbrain) semantic memory, git-backed `assisted_memory`, session `import`, and a stranded-session `watchdog`.
 Author: Pierre Samson, Claude Opus
 License: MIT

{swarph_cli-0.40.2 → swarph_cli-0.40.3}/src/swarph_cli.egg-info/SOURCES.txt

@@ -189,6 +189,7 @@ tests/test_providers_isolation.py
 tests/test_ratify_command.py
 tests/test_repl_caller_convention.py
 tests/test_schedule_command.py
+tests/test_schedule_create_contract.py
 tests/test_security.py
 tests/test_service_app.py
 tests/test_service_command.py

{swarph_cli-0.40.2 → swarph_cli-0.40.3}/tests/test_brain_ask_command.py

@@ -17,7 +17,7 @@ from swarph_cli.commands import brain_ask as ba
 
 def test_version_is_0_33_0():
     import swarph_cli
-    assert swarph_cli.__version__ == "0.40.2"
+    assert swarph_cli.__version__ == "0.40.3"
 
 
 # --- request / response plumbing -------------------------------------------

{swarph_cli-0.40.2 → swarph_cli-0.40.3}/tests/test_meta_edge_identity.py

@@ -331,3 +331,50 @@ def test_shared_token_register_list_auth_unchanged(gw, client):
     with pytest.raises(gw.HTTPException) as e:
         gw._authorize("Bearer totally-wrong-token")
     assert e.value.status_code == 401
+
+
+# ══ 7. BLOCKER-B — a Meta-Edge login is NOT an operator ════════════════════
+#
+# The shipped _is_operator was `return auth.peer is None`. Both the SSO
+# identity context AND the cell-join context carry peer=None (only the genuine
+# shared/commander token does AND has kind=None), so every OAuth login resolved
+# to a full operator — an OAuth-driven operator factory. The genuine operator is
+# the shared token alone: peer is None AND kind is None.
+
+def test_is_operator_only_for_shared_token_not_meta_edge(gw):
+    """Unit: the precise close. Shared token = operator; user_identity and
+    cell_join (both peer=None) are NOT; a per-peer cell is NOT."""
+    shared = gw.AuthContext(peer=None, regime="shared_token", key_generation=None)
+    identity = gw.AuthContext(kind="user_identity", user="u-123",
+                              provider="github", login="octocat")
+    join = gw.AuthContext(kind="cell_join", owner="u-123")
+    cell = gw.AuthContext(peer="some-cell", regime="peer_token", key_generation=1)
+
+    assert gw._is_operator(shared) is True
+    assert gw._is_operator(identity) is False   # was True → the operator factory
+    assert gw._is_operator(join) is False        # the cell-join hole, closed too
+    assert gw._is_operator(cell) is False
+
+
+def test_user_identity_denied_at_operator_gated_route(gw, client, sign):
+    """Wiring: an SSO identity token is 403'd at an operator-gated route
+    (announce-channel create, B5). Pre-fix this created the channel (200) —
+    the catch must be COMMITTED, not just present on the helper."""
+    tok = sign(_base_claims())  # a valid user_identity token (purpose absent)
+    r = client.post(
+        "/channels",
+        json={"name": "sso-cannot-make-this", "kind": "announce",
+              "created_by": "u-123"},
+        headers=_bearer(tok),
+    )
+    assert r.status_code == 403, r.text
+    assert "operator-gated" in r.text
+
+    # control: the shared/commander token IS the operator and succeeds.
+    r2 = client.post(
+        "/channels",
+        json={"name": "operator-can", "kind": "announce",
+              "created_by": "commander"},
+        headers=_bearer(SHARED_TOKEN),
+    )
+    assert r2.status_code == 200, r2.text

{swarph_cli-0.40.2 → swarph_cli-0.40.3}/tests/test_schedule_command.py

@@ -67,8 +67,8 @@ def test_schedule_create_posts_event(monkeypatch):
         "--target", "c2",
         "--task", "summarize the day",
         "--cron", "0 9 * * *",
-        "--context", "ref1",
-        "--context", "ref2",
+        "--context", "memory=proj_x",
+        "--context", "repo=swarph-cli",
         "--out-channel", "general",
         "--min-interval", "300",
     ])
@@ -80,28 +80,59 @@ def test_schedule_create_posts_event(monkeypatch):
     assert body["target_cell"] == "c2"
     assert body["task"] == "summarize the day"
     assert body["created_by"] == "c1"
-    assert body["context_ref"] == ["ref1", "ref2"]
     assert body["cron"] == "0 9 * * *"
     assert body["out_channel"] == "general"
     assert body["min_interval_sec"] == 300
+    # Card #146: anchors must reach the gateway as DICTS. This assertion is the
+    # one the original test was missing — it asserted the POST happened, never
+    # that the BODY was one the gateway accepts.
+    assert body["context_ref"] == [{"memory": "proj_x"}, {"repo": "swarph-cli"}]
 
 
 def test_schedule_create_minimal_omits_optionals(monkeypatch):
+    """>>> THIS TEST USED TO ASSERT THE BUG (card #146). <<<
+
+    It ran `create` with NO --context, asserted rc == 0, and asserted
+    `body["context_ref"] == []`. The gateway REQUIRES a non-empty context_ref, so the
+    behaviour this test pinned as correct was the behaviour that made every real
+    `schedule create` fail with a 400.
+
+    It stayed green for months because it MOCKS THE POST: it verified that the CLI
+    sends what the CLI sends. A mocked transport cannot fail a contract it never
+    talks to — the same shape as a fixture building a card the real system cannot
+    produce.
+
+    Now: the optionals are still omitted, but --context is supplied because it is
+    genuinely required, and the no-context case is asserted to FAIL LOCALLY below.
+    """
     seen = _capture_post(monkeypatch)
     rc = sc.run_schedule([
         "create", "ev",
         "--trigger", "event",
         "--target", "c2",
         "--task", "do thing",
+        "--context", "memory=proj_x",
     ])
     assert rc == 0
     body = seen["body"]
-    assert body["context_ref"] == []
+    assert body["context_ref"] == [{"memory": "proj_x"}]
     assert "cron" not in body
     assert "out_channel" not in body
     assert "min_interval_sec" not in body
 
 
+def test_schedule_create_without_context_fails_LOCALLY_and_never_posts(monkeypatch):
+    """The replacement for what the old minimal test asserted. An event with no
+    durable anchor is refused BEFORE the network, so the user gets the reason and
+    the input rather than a server 400 they must reverse-engineer."""
+    seen = _capture_post(monkeypatch)
+    rc = sc.run_schedule([
+        "create", "ev", "--trigger", "event", "--target", "c2", "--task", "do thing",
+    ])
+    assert rc == 2
+    assert not seen, "a request with no anchors must never reach the gateway"
+
+
 def test_schedule_enable_posts(monkeypatch):
     seen = _capture_post(monkeypatch)
     rc = sc.run_schedule(["enable", "daily-digest"])

swarph_cli-0.40.3/tests/test_schedule_create_contract.py

@@ -0,0 +1,154 @@
+"""Card #146 — `swarph schedule create` could never succeed.
+
+>>> THE CLI SENT --context VALUES AS RAW STRINGS. THE GATEWAY REQUIRES EACH ANCHOR TO
+    BE A DICT CARRYING A DURABLE KEY, AND REQUIRES THE LIST TO BE NON-EMPTY. SO EVERY
+    INVOCATION 400'd, UNCONDITIONALLY. <<<
+
+The cost was not the broken verb. It was that the verb which makes a DATE FIRE was
+itself broken, so arming a reminder always cost a hand-written raw-API call — and the
+cheapest path was therefore to tell a peer in a DM and hope. Board cards #129/#168
+(stale dependency gates) and the graduation register are downstream of exactly this:
+dates lived in conversations because the mechanism for dates did not work.
+
+This file pins the CONTRACT, not the implementation:
+  · the parser produces the dict shape the gateway accepts
+  · a non-durable / malformed anchor fails LOCALLY, naming the valid keys
+  · an EMPTY context list fails locally rather than as a server 400
+  · the CLI's copy of the durable-key set MATCHES THE GATEWAY'S — the drift check,
+    because a duplicated constant nobody compares is how the two sides diverged
+"""
+import json
+import re
+from pathlib import Path
+
+import pytest
+
+from swarph_cli.commands.schedule import DURABLE_ANCHOR_KEYS, parse_context_anchor
+
+
+# ── the shape the gateway actually wants ────────────────────────────────────
+
+@pytest.mark.parametrize("raw,want", [
+    ("memory=project_graduation_register", {"memory": "project_graduation_register"}),
+    ("repo=swarph-cli",                    {"repo": "swarph-cli"}),
+    ("channel=System",                     {"channel": "System"}),
+    ("feature=scheduler",                  {"feature": "scheduler"}),
+    ("file=docs/PLAN.md",                  {"file": "docs/PLAN.md"}),
+    ('{"memory": "x"}',                    {"memory": "x"}),
+])
+def test_shorthand_and_json_both_produce_anchor_dicts(raw, want):
+    assert parse_context_anchor(raw) == want
+
+
+def test_the_old_behaviour_is_exactly_what_the_gateway_rejects():
+    """>>> THE REGRESSION PIN. The pre-fix CLI passed the raw string through. <<<
+
+    The gateway's check is `not isinstance(anchor, dict) or not (set(anchor) &
+    DURABLE_ANCHOR_KEYS)`, so a bare string failed the FIRST clause. If someone
+    "simplifies" the parser back to a pass-through, this fails instead of the verb
+    silently 400-ing again for another two months.
+    """
+    got = parse_context_anchor("memory=x")
+    assert isinstance(got, dict), "a raw string is what made this verb unusable"
+    assert set(got) & DURABLE_ANCHOR_KEYS
+
+
+# ── failing LOCALLY, with the input the user is holding ─────────────────────
+
+@pytest.mark.parametrize("bad", [
+    "project_x",                 # the natural thing to type — no key at all
+    "session=abc",               # a real key name, but not a durable one
+    "memory=",                   # key with no value
+    "",                          # empty
+    "{not json}",                # looks like JSON, is not
+    '["memory"]',                # JSON, but not an object
+    '{"note": "x"}',             # object, but no durable key
+])
+def test_bad_anchors_raise_locally_and_name_the_valid_keys(bad):
+    with pytest.raises(ValueError) as e:
+        parse_context_anchor(bad)
+    msg = str(e.value)
+    assert bad[:20] in msg or "durable" in msg or "empty" in msg, msg
+
+
+def test_the_error_lists_the_actual_keys_not_a_vague_rule():
+    """A 400 from the gateway names the RULE; it does not name the INPUT that broke
+    it, and the user is the one holding the input. The local error must do both."""
+    with pytest.raises(ValueError) as e:
+        parse_context_anchor("session=abc")
+    msg = str(e.value)
+    assert "session" in msg, "the error must quote the offending key"
+    for k in ("memory", "repo", "channel", "feature", "file"):
+        assert k in msg, f"the error must list {k!r} as a valid alternative"
+
+
+# ── the drift check: the two sides must agree ───────────────────────────────
+
+# >>> THIS IS THE DEPLOYED TREE, NOT A CHECKOUT — AND THAT IS DELIBERATE. <<<
+# Measured 2026-07-30: the deployed gateway (6e3e01a) is NOT origin/main (b10c3ad).
+# Reading the deployed path validates the CLI against THE CONTRACT CURRENTLY SERVING
+# rather than the one that happens to be merged — the artifact-vs-source distinction
+# that cost us the 0.40.0 release, applied on purpose this time.
+#
+# CONSEQUENCE A FUTURE READER MUST HAVE (droplet, PR #161 review): a green here means
+# "the CLI satisfies the gateway RUNNING RIGHT NOW", never "the CLI satisfies main".
+# So the next time someone `git pull`s the gateway, THESE TESTS CAN GO RED WITH NO CLI
+# CHANGE AT ALL.
+# >>> A RED HERE MEANS THE CONTRACT MOVED. It is the drift check working, not a CLI
+#     regression. Check the gateway diff before you touch this package. <<<
+GATEWAY = Path("/home/ubuntu/mesh-gateway/server.py")
+
+
+@pytest.mark.skipif(not GATEWAY.exists(), reason="mesh-gateway source not on this box")
+def test_the_cli_durable_keys_match_the_gateway_the_client_talks_to():
+    """>>> THE CHECK THAT WOULD HAVE CAUGHT #146 AT BIRTH. <<<
+
+    Two codebases, one contract, and no test comparing them — so the CLI could send a
+    shape the gateway had never accepted and nothing said a word until a human tried
+    to arm a real event and got a 400 they had to reverse-engineer.
+
+    Skipped where mesh-gateway is absent (most CI runners), and SKIPPED MEANS NOT
+    VERIFIED, not verified-OK — pytest counts and prints it. On the lab host, where
+    both live, it runs and is authoritative.
+    """
+    src = GATEWAY.read_text(encoding="utf-8")
+    m = re.search(r"_DURABLE_ANCHOR_KEYS\s*=\s*frozenset\(\{([^}]*)\}\)", src)
+    assert m, "could not locate _DURABLE_ANCHOR_KEYS in the gateway — the drift check is blind"
+    gateway_keys = set(re.findall(r'"([a-z_]+)"', m.group(1)))
+    assert gateway_keys == set(DURABLE_ANCHOR_KEYS), (
+        f"CLI and gateway disagree on durable anchor keys: "
+        f"cli={sorted(DURABLE_ANCHOR_KEYS)} gateway={sorted(gateway_keys)}")
+
+
+@pytest.mark.skipif(not GATEWAY.exists(), reason="mesh-gateway source not on this box")
+def test_anchors_pass_the_GATEWAYS_OWN_validator_not_a_local_copy():
+    """>>> THE END-TO-END CHECK, AND THE ONLY ONE THAT ACTUALLY PROVES THE FIX. <<<
+
+    A live POST cannot prove it: the gateway checks AUTHZ (server.py ~3707) BEFORE it
+    validates the payload (~3728), so a non-operator caller gets an identical 403 for
+    a well-formed and a malformed body. The measurement returns the same value whether
+    the fix works or not — which is exactly the proxy this card's whole family is about,
+    and it means the CLI's correctness is UNTESTABLE end-to-end by most callers.
+
+    So instead of a mock or a local re-implementation, this executes the DEPLOYED
+    gateway's own `_anchor_is_durable` against what the parser actually emits. Real
+    function, real contract, no server and no token.
+    """
+    import re as _re
+    src = GATEWAY.read_text(encoding="utf-8")
+    ns = {}
+    keys = _re.search(r"_DURABLE_ANCHOR_KEYS\s*=\s*frozenset\(\{[^}]*\}\)", src)
+    fn = _re.search(r"def _anchor_is_durable\(anchor: dict\) -> bool:.*?\n    return True\n", src, _re.S)
+    assert keys and fn, "could not extract the gateway validator — this check is blind"
+    exec(keys.group(0), ns)
+    exec(fn.group(0), ns)
+    is_durable = ns["_anchor_is_durable"]
+
+    for raw in ("memory=project_x", "repo=swarph-cli", "channel=System",
+                "feature=scheduler", "file=docs/PLAN.md", '{"memory": "x"}'):
+        assert is_durable(parse_context_anchor(raw)), f"gateway would reject {raw!r}"
+
+    # and the pre-fix behaviour must still be rejected by that same validator
+    assert not is_durable("memory=x"), (
+        "a bare string is what the unpatched CLI sent; if the gateway now accepts it, "
+        "this test is measuring the wrong contract")

{swarph_cli-0.40.2 → swarph_cli-0.40.3}/tests/test_watchdog.py

@@ -1043,4 +1043,4 @@ def test_parser_defaults_process_name_claude_liveness_cmd_none():
 
 def test_version_is_0_33_0():
     import swarph_cli
-    assert swarph_cli.__version__ == "0.40.2"
+    assert swarph_cli.__version__ == "0.40.3"