swarph-cli 0.40.3__tar.gz → 0.41.0__tar.gz

{swarph_cli-0.40.3/src/swarph_cli.egg-info → swarph_cli-0.41.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: swarph-cli
-Version: 0.40.3
+Version: 0.41.0
 Summary: The `swarph` binary — a multi-LLM CLI and mesh-gateway client + bundled server (`swarph gateway`): one-shot prompts across providers, interactive `chat`, multi-provider `spawn` (claude/codex/antigravity via a ProviderMembrane with subprocess billing-scrub), `mesh` send/inbox/register, `brain-ask` over the swarph-brain (gbrain) semantic memory, git-backed `assisted_memory`, session `import`, and a stranded-session `watchdog`.
 Author: Pierre Samson, Claude Opus
 License: MIT

{swarph_cli-0.40.3 → swarph_cli-0.41.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "swarph-cli"
-version = "0.40.3"
+version = "0.41.0"
 description = "The `swarph` binary — a multi-LLM CLI and mesh-gateway client + bundled server (`swarph gateway`): one-shot prompts across providers, interactive `chat`, multi-provider `spawn` (claude/codex/antigravity via a ProviderMembrane with subprocess billing-scrub), `mesh` send/inbox/register, `brain-ask` over the swarph-brain (gbrain) semantic memory, git-backed `assisted_memory`, session `import`, and a stranded-session `watchdog`."
 readme = "README.md"
 license = { text = "MIT" }

{swarph_cli-0.40.3 → swarph_cli-0.41.0}/src/swarph_cli/__init__.py

@@ -16,6 +16,6 @@ The architecture splits CLI from substrate so:
 
 from __future__ import annotations
 
-__version__ = "0.40.3"
+__version__ = "0.41.0"
 
 __all__ = ["__version__"]

{swarph_cli-0.40.3 → swarph_cli-0.41.0}/src/swarph_cli/commands/codegraph.py

@@ -145,8 +145,27 @@ def structural_query(term, *, index_path, caller_cell, limit=8, allowlist=None)
             # verbatim edge kinds (contains/imports/decorates/references/calls/...), and counting
             # all of them would pollute the blast-radius number. 'calls' (plural) is CodeGraph's
             # actual call-edge kind.
+            #
+            # >>> CARD #194 — THE COUNT IS SCOPED TO THE CALLER-VISIBLE REPOS, exactly
+            # like the rows above. <<< This was an unscoped COUNT(*) while `s.repo IN
+            # (allowed)` gated the rows, so a caller who could NOT see a private repo
+            # still received a caller count that INCLUDED its callers.
+            #
+            # drop-on-meta-edge, seat-A: "a count that sums callers living in a private
+            # repo LEAKS THE EXISTENCE AND SIZE of those private callers — the exact
+            # payload #44's transport refuses, delivered as an integer instead of a
+            # path." Measured 2026-07-31: cross-visibility `calls` edges were 0 on the
+            # live index, so the leak was LATENT — but this is the blast-radius number
+            # the feature exists to serve, and the gateway proxy would have exposed it
+            # to every remote peer.
+            #
+            # The unifying rule: EVERY OBSERVABLE — rows, counts, scores, freshness —
+            # must be a function of only the caller-visible subset, never the full
+            # index. Gating the rows is ONE INSTANCE of it, not the whole of it.
             callers = con.execute(
-                "SELECT COUNT(*) FROM edges WHERE dst_symbol=? AND edge_type='calls'", (sid,)
+                f"SELECT COUNT(*) FROM edges e JOIN symbols src ON src.id = e.src_symbol "
+                f"WHERE e.dst_symbol=? AND e.edge_type='calls' AND src.repo IN ({qmarks})",
+                (sid, *sorted(allowed))
             ).fetchone()[0]
             out.append({"repo": repo, "name": name, "kind": kind,
                         "file_path": fp, "start_line": line, "callers": callers, "score": score,

swarph_cli-0.41.0/src/swarph_cli/commands/codegraph_hook.py

@@ -0,0 +1,233 @@
+"""``swarph codegraph-hook`` — PostToolUse(Bash) structural-search companion.
+
+WHEN A grep/rg SEARCHES CODE, ALSO ASK THE CODEGRAPH, and hand the structural
+answer back as context. Card #194.
+
+WHY IT EXISTS. Agents reach for grep where the symbol graph is the right
+instrument — lab-ovh was corrected three times in one session for exactly that,
+and the third correction landed INSIDE the fix for the first two. Instructions
+demonstrably do not hold at the moment of typing, so this is mechanical rather
+than a reminder. The token argument is the commander's: a grep that returns 200
+matching lines costs far more context than the six symbols that actually answer
+"where is this defined and who calls it".
+
+>>> IT SUPPLEMENTS, IT NEVER BLOCKS. <<< grep is genuinely correct for config,
+logs, /etc and string literals; the codegraph indexes SYMBOLS. The failure this
+guards is "I only ever saw grep's answer", not "grep was used".
+
+>>> AND IT MUST NEVER DEGRADE SILENTLY. <<< A missing index makes a structural
+query return `[]` — indistinguishable from a real negative, which is the exact
+shape of the (gbrain unreachable) incident and of card #200's drain. So an
+unavailable backend is reported LOUDLY as an incident, never as "no matches".
+
+PEER MODE. Unlike lab-ovh's original local hook, a peer has no local index — it
+asks the gateway's ``POST /codegraph`` proxy, which applies the A8 visibility
+gate to rows AND to caller counts (swarph-cli PR #165). The caller identity comes
+from the bearer token, never from a field, so it cannot be self-asserted.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import re
+import sys
+import urllib.error
+import urllib.request
+from pathlib import Path
+from typing import Optional
+
+DEFAULT_GATEWAY = os.environ.get("MESH_GATEWAY_URL", "http://localhost:8788")
+TIMEOUT_S = 6
+MAX_ROWS = 6
+
+# ── trigger heuristics ────────────────────────────────────────────────────
+# Ported from the hook that ran on lab-ovh for a day. Every one of these three
+# patterns exists because a LOOSER version misfired in production.
+
+# 1. grep/rg must be at COMMAND POSITION — line start, or right after a pipe /
+#    ; / && / $( . Matching "grep" after arbitrary whitespace fires on any command
+#    whose text merely MENTIONS the word, including a heredoc body: the first live
+#    firing did exactly that and extracted the heredoc delimiter as the search term.
+_AT_COMMAND_POS = re.compile(r"(?:^|[|;&]|\$\()\s*(?:sudo\s+)?(?:grep|rg)\s")
+
+# 2. A heredoc means most of the command is DATA, not shell — too noisy to parse.
+_HEREDOC = re.compile(r"<<-?['\"]?\w*(?:EOF|PY)")
+
+# 3. It should look like a CODE search, not a config/log one.
+_CODEISH = re.compile(
+    r"\.(?:py|ts|tsx|js|jsx|go|rs|java|rb|c|h|cpp)\b|--include|(?:^|\s)-r\s|src/"
+)
+
+
+def _looks_like_code_search(cmd: str) -> bool:
+    if not _AT_COMMAND_POS.search(cmd):
+        return False
+    if _HEREDOC.search(cmd):
+        return False
+    return bool(_CODEISH.search(cmd))
+
+
+def extract_term(cmd: str) -> Optional[str]:
+    """The search term ADJACENT to grep — not the first quoted string anywhere.
+
+    A `gh pr close --comment "...'dead'..." && grep foo bar` fired a query for
+    'dead', lifted out of unrelated prose. So the scan starts AT the grep token.
+    """
+    m = _AT_COMMAND_POS.search(cmd)
+    if not m:
+        return None
+    tail = cmd[m.end():]
+    # Skip flags (-n, -R, --include=*.py, …) to reach the pattern itself.
+    for tok in _tokenize(tail):
+        if tok.startswith("-"):
+            continue
+        term = tok.strip("'\"")
+        # A regex-metachar soup is not a useful symbol query.
+        cleaned = re.sub(r"[^\w\s.]", " ", term).strip()
+        return cleaned or None
+    return None
+
+
+def _tokenize(s: str) -> list:
+    """Shell-ish split that keeps quoted strings together.
+
+    NOTE: no early break. An earlier version stopped after the FIRST completed
+    token, so a command whose first argument is a flag (`grep -rn 'pat' src/`)
+    yielded only `-rn`, the caller skipped it as a flag, and extraction returned
+    None — the hook silently never fired on the most common grep shape there is.
+    Caught by test_skips_flags_to_reach_the_pattern.
+    """
+    out, cur, quote, started = [], "", None, False
+    for ch in s:
+        if quote:
+            if ch == quote:
+                quote = None
+            else:
+                cur += ch
+        elif ch in "'\"":
+            quote, started = ch, True
+        elif ch.isspace():
+            if cur or started:
+                out.append(cur)
+                cur, started = "", False
+        else:
+            cur += ch
+            started = True
+    if cur or started:
+        out.append(cur)
+    return out
+
+
+# ── gateway query ─────────────────────────────────────────────────────────
+
+def _token_path(self_name: str) -> Path:
+    return Path.home() / ".config" / "swarph" / f"{self_name}.peer_token"
+
+
+def query_gateway(term: str, gateway: str, token: str, limit: int = MAX_ROWS) -> dict:
+    """POST /codegraph. Returns the envelope, or {"error": "..."} — NEVER {}.
+
+    >>> AN UNREACHABLE OR REFUSING BACKEND IS AN ERROR, NOT AN EMPTY RESULT. <<<
+    Collapsing them is the defect this hook exists to avoid teaching.
+    """
+    req = urllib.request.Request(
+        f"{gateway.rstrip('/')}/codegraph",
+        data=json.dumps({"query": term, "limit": limit}).encode(),
+        headers={"Authorization": f"Bearer {token}",
+                 "Content-Type": "application/json"},
+        method="POST",
+    )
+    try:
+        with urllib.request.urlopen(req, timeout=TIMEOUT_S) as r:
+            return json.loads(r.read().decode())
+    except urllib.error.HTTPError as e:
+        detail = ""
+        try:
+            detail = json.loads(e.read().decode()).get("detail", "")
+        except Exception:  # noqa: BLE001
+            pass
+        return {"error": f"HTTP {e.code}: {detail or e.reason}"}
+    except Exception as e:  # noqa: BLE001 — transport/parse
+        return {"error": f"{type(e).__name__}: {e}"}
+
+
+def render(term: str, env: dict) -> str:
+    """Format the envelope for injection. Errors are LOUD and named."""
+    if "error" in env:
+        return (f"CODEGRAPH UNAVAILABLE for '{term}' — {env['error']}\n"
+                f"  >>> THIS IS NOT 'no matches'. The structural index could not be "
+                f"consulted, so grep's answer is the ONLY answer you have. Treat "
+                f"definitions/callers as UNVERIFIED.")
+
+    rows = env.get("results") or []
+    fresh = env.get("freshness") or []
+    stale = [f for f in fresh if f.get("stale")]
+    age = ""
+    if fresh:
+        hrs = max((f.get("index_age_hours") or 0) for f in fresh)
+        age = f", index {hrs:.1f}h old"
+        if stale:
+            age += " ⚠ STALE — verify line numbers against the file"
+
+    if not rows:
+        body = ("  no structural matches (the index IS present and answered — "
+                "a REAL negative)")
+    else:
+        body = "\n".join(
+            f"  {r.get('repo')}/{r.get('file_path')}:{r.get('start_line')}  "
+            f"{r.get('kind')} {r.get('name')}  callers={r.get('callers')}"
+            for r in rows[:MAX_ROWS]
+        )
+    return (f"CODEGRAPH (structural{age}) for '{term}' — grep found text; this is "
+            f"the symbol graph, incl. CALLER COUNTS grep cannot see:\n{body}\n\n"
+            f"Use this for definitions/callers/blast-radius. grep remains correct "
+            f"for config, logs and string literals the codegraph does not index.")
+
+
+def run_codegraph_hook(argv: Optional[list] = None) -> int:
+    """PostToolUse(Bash) entry point. ALWAYS exits 0 — it must never fail a turn."""
+    argv = list(argv or [])
+    self_name = os.environ.get("SWARPH_SELF", "").strip()
+    gateway = DEFAULT_GATEWAY
+    for i, a in enumerate(argv):
+        if a == "--as" and i + 1 < len(argv):
+            self_name = argv[i + 1]
+        elif a == "--gateway" and i + 1 < len(argv):
+            gateway = argv[i + 1]
+
+    try:
+        payload = json.loads(sys.stdin.read() or "{}")
+    except Exception:  # noqa: BLE001
+        return 0
+    cmd = ((payload.get("tool_input") or {}).get("command") or "").strip()
+    if not cmd or not _looks_like_code_search(cmd):
+        return 0
+    term = extract_term(cmd)
+    if not term:
+        return 0
+
+    if not self_name:
+        _emit(f"CODEGRAPH SKIPPED for '{term}' — no cell identity (set SWARPH_SELF "
+              f"or pass --as). Not a negative result: the graph was never asked.")
+        return 0
+    tp = _token_path(self_name)
+    try:
+        token = tp.read_text().strip()
+    except OSError as e:
+        _emit(f"CODEGRAPH UNAVAILABLE for '{term}' — peer token unreadable at {tp}: "
+              f"{e}. Not a negative result: the graph was never asked.")
+        return 0
+
+    _emit(render(term, query_gateway(term, gateway, token)))
+    return 0
+
+
+def _emit(text: str) -> None:
+    """Hand context back to the model via the documented hook JSON shape."""
+    print(json.dumps({
+        "hookSpecificOutput": {
+            "hookEventName": "PostToolUse",
+            "additionalContext": text,
+        }
+    }))

{swarph_cli-0.40.3 → swarph_cli-0.41.0}/src/swarph_cli/commands/hooks.py

@@ -155,7 +155,43 @@ exit 0
 """
 
 
+# The bundled codegraph-on-grep script (card #194). Deliberately a THIN WRAPPER
+# around `swarph codegraph-hook` rather than fat inline shell: the trigger
+# heuristics are the hard-won part — each guard in that module exists because a
+# LOOSER version misfired in production (a heredoc delimiter extracted as the
+# search term; a quoted string lifted out of unrelated prose) — and heuristics
+# that specific must be unit-testable, which inline sh is not. Same pattern as
+# `install-hook`, which points at `swarph hook-output`.
+#
+# `exec` so the hook process IS the handler, and the verb always exits 0: a
+# PostToolUse hook must never fail a turn.
+_CODEGRAPH_ON_GREP_SH = r"""#!/bin/sh
+# codegraph-on-grep.sh — swarph bundled Claude Code hook (PostToolUse/Bash).
+#
+# When a grep/rg searches CODE, also ask the gateway's structural codegraph and
+# hand the symbol-level answer back as context. Supplements grep, never blocks it.
+# All logic lives in `swarph codegraph-hook` so it can be tested; see that module
+# for why each trigger guard exists.
+exec swarph codegraph-hook "$@"
+"""
+
 BUILTIN_HOOKS: dict = {
+    "codegraph-on-grep": HookBundle(
+        name="codegraph-on-grep",
+        description=(
+            "When a grep/rg searches code, also queries the gateway's structural "
+            "codegraph and injects the symbol-level answer (definitions, file:line, "
+            "caller counts) as context. Supplements grep; never blocks it. Reports "
+            "an unavailable index LOUDLY rather than as 'no matches'."
+        ),
+        publisher="swarph-builtin",
+        trust="builtin",
+        script_name="codegraph-on-grep.sh",
+        script_body=_CODEGRAPH_ON_GREP_SH,
+        bindings=(
+            HookBinding("PostToolUse", "Bash"),
+        ),
+    ),
     "cell-resilience": HookBundle(
         name="cell-resilience",
         description=(

{swarph_cli-0.40.3 → swarph_cli-0.41.0}/src/swarph_cli/commands/mesh.py

@@ -1045,16 +1045,93 @@ def _proc_cmdline(pid: int) -> Optional[str]:
     return raw.replace(b"\x00", b" ").decode("utf-8", "replace").strip() or None
 
 
-def _process_alive(pid: int) -> bool:
+# Liveness is TRI-STATE. "I could not determine" is not "dead" — see _process_liveness.
+LIVENESS_ALIVE = "alive"
+LIVENESS_DEAD = "dead"
+LIVENESS_UNKNOWN = "unknown"
+
+
+def _windows_liveness(pid: int) -> str:
+    """Ask Windows directly, via OpenProcess — never via os.kill.
+
+    PROCESS_QUERY_LIMITED_INFORMATION (0x1000) is the minimum right that answers
+    "does this pid exist", and it is grantable across sessions where the rights
+    os.kill needs are not. ERROR_ACCESS_DENIED means the process EXISTS and we may
+    not inspect it — that is ALIVE, not dead. ERROR_INVALID_PARAMETER means no such
+    pid. Anything else is UNKNOWN, never dead.
+    """
+    try:
+        import ctypes
+        from ctypes import wintypes
+    except Exception:                                  # noqa: BLE001
+        return LIVENESS_UNKNOWN
+    ERROR_ACCESS_DENIED, ERROR_INVALID_PARAMETER, STILL_ACTIVE = 5, 87, 259
+    try:
+        k32 = ctypes.WinDLL("kernel32", use_last_error=True)
+        handle = k32.OpenProcess(0x1000, False, pid)
+        if not handle:
+            err = ctypes.get_last_error()
+            if err == ERROR_ACCESS_DENIED:
+                return LIVENESS_ALIVE                  # exists; we just cannot look
+            if err == ERROR_INVALID_PARAMETER:
+                return LIVENESS_DEAD                   # no such pid
+            return LIVENESS_UNKNOWN
+        try:
+            code = wintypes.DWORD()
+            if not k32.GetExitCodeProcess(handle, ctypes.byref(code)):
+                return LIVENESS_UNKNOWN
+            return LIVENESS_ALIVE if code.value == STILL_ACTIVE else LIVENESS_DEAD
+        finally:
+            k32.CloseHandle(handle)
+    except Exception:                                  # noqa: BLE001
+        return LIVENESS_UNKNOWN
+
+
+def _process_liveness(pid: int) -> str:
+    """'alive' | 'dead' | 'unknown'.
+
+    >>> CARD #195 — `os.kill(pid, 0)` IS NOT A LIVENESS PROBE ON WINDOWS, AND ITS
+    FAILURE WAS BEING SWALLOWED INTO "DEAD". <<< Measured by workstation-lc against
+    a monitor that was demonstrably draining:
+
+        pid 6120 alive per Windows ................. True
+        os.kill(6120, 0) from another process ...... OSError [WinError 87]
+                                                     -> `except OSError: return False`
+        pid 6120 after the probe ................... STILL ALIVE
+
+    The error appears when probing a process the caller did NOT spawn — the worker
+    is a grandchild of a detached cmd.exe, a different session/handle-rights context.
+    His first throwaway test passed because he probed his own CHILD: a child-process
+    control cannot surface this, which is why it read safe.
+
+    ONE LINE PRODUCED BOTH SYMPTOMS: `monitor status` reported "not running" about
+    every healthy monitor, AND the single-instance guard believed nothing was
+    running, so it never blocked a second start. False negative and duplicate
+    spawning from the same swallow.
+
+    >>> THE RULE: "COULD NOT DETERMINE" MUST NEVER BE REPORTED AS "DEAD" BY A GUARD
+    WHOSE JOB IS TO PREVENT A SECOND START. <<< A blocked start is visible and
+    recoverable; a duplicate is silent and produces two writers over one cursor.
+    So callers treat UNKNOWN as occupied, and `status` says so rather than claiming
+    the process is running.
+    """
+    if sys.platform == "win32":
+        return _windows_liveness(pid)
     try:
         os.kill(pid, 0)
     except ProcessLookupError:
-        return False
+        return LIVENESS_DEAD
     except PermissionError:
-        return True            # exists, owned by another user
+        return LIVENESS_ALIVE       # exists, owned by another user
     except OSError:
-        return False
-    return True
+        return LIVENESS_UNKNOWN     # NOT dead — we simply could not tell
+    return LIVENESS_ALIVE
+
+
+def _process_alive(pid: int) -> bool:
+    """Back-compat bool. UNKNOWN counts as alive — see _process_liveness for why
+    treating an undetermined answer as "dead" is the failure mode, not the safe one."""
+    return _process_liveness(pid) in (LIVENESS_ALIVE, LIVENESS_UNKNOWN)
 
 
 def _terminate(pid: int) -> None:

{swarph_cli-0.40.3 → swarph_cli-0.41.0}/src/swarph_cli/main.py

@@ -84,6 +84,7 @@ _VERB_HANDLERS: dict[str, str] = {
     "spawn": "swarph_cli.commands.spawn.run_spawn",
     "install-hook": "swarph_cli.commands.install_hook.run_install_hook",
     "hook-output": "swarph_cli.commands.hook_output.run_hook_output",
+    "codegraph-hook": "swarph_cli.commands.codegraph_hook.run_codegraph_hook",
     "watchdog": "swarph_cli.commands.watchdog.run_watchdog",
     "hooks": "swarph_cli.commands.hooks.run_hooks",
     "protocol-handler": "swarph_cli.commands.protocol_handler.run_protocol_handler",

{swarph_cli-0.40.3 → swarph_cli-0.41.0/src/swarph_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: swarph-cli
-Version: 0.40.3
+Version: 0.41.0
 Summary: The `swarph` binary — a multi-LLM CLI and mesh-gateway client + bundled server (`swarph gateway`): one-shot prompts across providers, interactive `chat`, multi-provider `spawn` (claude/codex/antigravity via a ProviderMembrane with subprocess billing-scrub), `mesh` send/inbox/register, `brain-ask` over the swarph-brain (gbrain) semantic memory, git-backed `assisted_memory`, session `import`, and a stranded-session `watchdog`.
 Author: Pierre Samson, Claude Opus
 License: MIT

{swarph_cli-0.40.3 → swarph_cli-0.41.0}/src/swarph_cli.egg-info/SOURCES.txt

@@ -46,6 +46,7 @@ src/swarph_cli/commands/cell_selfcheck.py
 src/swarph_cli/commands/channel.py
 src/swarph_cli/commands/chat.py
 src/swarph_cli/commands/codegraph.py
+src/swarph_cli/commands/codegraph_hook.py
 src/swarph_cli/commands/compress.py
 src/swarph_cli/commands/daemon.py
 src/swarph_cli/commands/event.py
@@ -130,7 +131,9 @@ tests/test_channel_post.py
 tests/test_chat_command.py
 tests/test_claude_parser.py
 tests/test_claude_tmux_template.py
+tests/test_codegraph_caller_scope.py
 tests/test_codegraph_command.py
+tests/test_codegraph_hook.py
 tests/test_codegraph_mcp.py
 tests/test_compress_caller_convention.py
 tests/test_compress_command.py
@@ -184,6 +187,7 @@ tests/test_multiplexer.py
 tests/test_okf_links.py
 tests/test_onboard_command.py
 tests/test_packaged_artifacts_exist.py
+tests/test_process_liveness.py
 tests/test_protocol_handler.py
 tests/test_providers_isolation.py
 tests/test_ratify_command.py

{swarph_cli-0.40.3 → swarph_cli-0.41.0}/tests/test_brain_ask_command.py

@@ -17,7 +17,7 @@ from swarph_cli.commands import brain_ask as ba
 
 def test_version_is_0_33_0():
     import swarph_cli
-    assert swarph_cli.__version__ == "0.40.3"
+    assert swarph_cli.__version__ == "0.41.0"
 
 
 # --- request / response plumbing -------------------------------------------

swarph_cli-0.41.0/tests/test_codegraph_caller_scope.py

@@ -0,0 +1,103 @@
+"""Card #194 — the caller COUNT must be a function of the caller-visible subset.
+
+drop-on-meta-edge, seat-A, reviewing the `POST /codegraph` gateway proxy spec:
+
+    "If a symbol's caller count sums callers that live in a PRIVATE repo the
+     querying peer cannot see, THE NUMBER LEAKS THE EXISTENCE AND SIZE of those
+     private callers — the exact payload #44's transport refuses, delivered as an
+     integer instead of a path."
+
+`structural_query` gates the ROWS with `s.repo IN (allowed)` but counted callers with
+a bare `SELECT COUNT(*) FROM edges WHERE dst_symbol=? AND edge_type='calls'` — no
+repo scoping at all. Measured on the live index 2026-07-31: cross-visibility `calls`
+edges are 0 today, so the leak was LATENT rather than live — but it is in shipped
+code, and the proxy would have exposed it to every remote peer.
+
+The unifying rule this test enforces: EVERY OBSERVABLE — rows, counts, scores,
+freshness — must be a function of only the caller-visible subset, never the full
+index. "Filter in SQL, not post-LIMIT" is one instance of it; this is another.
+"""
+import os
+import sqlite3
+
+import pytest
+
+from swarph_cli.commands import codegraph as cg
+
+
+@pytest.fixture()
+def cross_visibility_index(tmp_path):
+    """`pub` (public) holds target_fn and one caller; `priv` (private) holds another.
+
+    Both callers reach target_fn by a 'calls' edge, so the UNSCOPED count is 2 and
+    the correctly-scoped count depends on who is asking.
+    """
+    p = os.path.join(tmp_path, "i.db")
+    c = sqlite3.connect(p)
+    c.executescript(
+        "CREATE TABLE repos(name TEXT PRIMARY KEY, slug TEXT, path TEXT, visibility TEXT, indexed_at TEXT);"
+        "CREATE TABLE symbols(id INTEGER PRIMARY KEY, repo TEXT, name TEXT, kind TEXT, file_path TEXT, start_line INTEGER,"
+        " qualified_name TEXT, docstring TEXT, signature TEXT, name_search TEXT);"
+        "CREATE TABLE edges(src_symbol INTEGER, dst_symbol INTEGER, edge_type TEXT, repo TEXT);"
+        "CREATE VIRTUAL TABLE symbols_fts USING fts5(name_search, qualified_name, docstring, signature,"
+        " content='symbols', content_rowid='id', tokenize=\"porter unicode61 separators '_.'\");")
+    c.execute("INSERT INTO repos VALUES('pub','o/pub','/p','public','t')")
+    c.execute("INSERT INTO repos VALUES('priv','o/priv','/q','private','t')")
+    ins = ("INSERT INTO symbols(id,repo,name,kind,file_path,start_line,qualified_name,"
+           "docstring,signature,name_search) VALUES(?,?,?,?,?,?,?,?,?,?)")
+    c.execute(ins, (1, "pub", "targetFn", "function", "a.py", 1, "pub.targetFn",
+                    "the widely called target", "def targetFn()", "targetFn target fn"))
+    c.execute(ins, (2, "pub", "publicCaller", "function", "b.py", 1, "pub.publicCaller",
+                    "calls the target", "def publicCaller()", "publicCaller public caller"))
+    c.execute(ins, (3, "priv", "privateCaller", "function", "c.py", 1, "priv.privateCaller",
+                    "calls the target", "def privateCaller()", "privateCaller private caller"))
+    c.execute("INSERT INTO edges VALUES(2,1,'calls','pub')")
+    c.execute("INSERT INTO edges VALUES(3,1,'calls','priv')")
+    c.execute("INSERT INTO symbols_fts(rowid,name_search,qualified_name,docstring,signature) "
+              "SELECT id,name_search,qualified_name,docstring,signature FROM symbols")
+    c.commit()
+    c.close()
+    return p
+
+
+def _target(rows):
+    return next(r for r in rows if r["name"] == "targetFn")
+
+
+def test_caller_count_excludes_invisible_repos(cross_visibility_index):
+    """THE REGRESSION. Same symbol, two callers, two different counts."""
+    granted = cg.structural_query("the widely called target",
+                                  index_path=cross_visibility_index,
+                                  caller_cell="owner", limit=8,
+                                  allowlist={"priv": ["owner"]})
+    stranger = cg.structural_query("the widely called target",
+                                   index_path=cross_visibility_index,
+                                   caller_cell="stranger", limit=8,
+                                   allowlist={})
+
+    assert _target(granted)["callers"] == 2, "the granted caller should see both callers"
+    assert _target(stranger)["callers"] == 1, (
+        "the public-only caller saw a count including a PRIVATE caller — the number "
+        "leaks the existence and size of a repo it cannot see (#44's payload as an int)")
+
+
+def test_rows_were_already_gated_and_still_are(cross_visibility_index):
+    """Guard against 'fixing' the count by widening the rows."""
+    stranger = cg.structural_query("calls the target",
+                                   index_path=cross_visibility_index,
+                                   caller_cell="stranger", limit=8, allowlist={})
+    assert {r["repo"] for r in stranger} == {"pub"}
+    assert all(r["name"] != "privateCaller" for r in stranger)
+
+
+def test_public_only_symbol_count_is_unchanged(cross_visibility_index):
+    """Non-vacuity in the other direction: the fix must not deflate honest counts.
+
+    A caller who CAN see everything must still get the true total — otherwise the
+    'fix' is just under-reporting, which is a different lie.
+    """
+    granted = cg.structural_query("the widely called target",
+                                  index_path=cross_visibility_index,
+                                  caller_cell="owner", limit=8,
+                                  allowlist={"priv": ["owner"]})
+    assert _target(granted)["callers"] == 2