swarph-cli 0.41.0__tar.gz → 0.41.1__tar.gz

{swarph_cli-0.41.0/src/swarph_cli.egg-info → swarph_cli-0.41.1}/PKG-INFO

@@ -1,13 +1,12 @@
 Metadata-Version: 2.4
 Name: swarph-cli
-Version: 0.41.0
+Version: 0.41.1
 Summary: The `swarph` binary — a multi-LLM CLI and mesh-gateway client + bundled server (`swarph gateway`): one-shot prompts across providers, interactive `chat`, multi-provider `spawn` (claude/codex/antigravity via a ProviderMembrane with subprocess billing-scrub), `mesh` send/inbox/register, `brain-ask` over the swarph-brain (gbrain) semantic memory, git-backed `assisted_memory`, session `import`, and a stranded-session `watchdog`.
 Author: Pierre Samson, Claude Opus
 License: MIT
 Project-URL: Homepage, https://github.com/BrainSurfing-tech/swarph-cli
 Project-URL: Source, https://github.com/BrainSurfing-tech/swarph-cli
 Project-URL: Substrate, https://github.com/BrainSurfing-tech/swarph-mesh
-Project-URL: Spec, https://github.com/darw007d/hedge-fund-mcp/blob/main/research/swarph_cli/PLAN.md
 Keywords: swarph,llm,cli,mesh,gemini,claude,deepseek
 Classifier: Development Status :: 3 - Alpha
 Classifier: Environment :: Console
@@ -467,13 +466,41 @@ swarph watchdog --check --peer researcher --gateway http://localhost:8788 --dm-w
 Installs Claude Code hooks as **content** wired into `~/.claude/settings.json` — a hook becomes an installable artifact (a script + its event/matcher bindings merged into your settings) with no swarph-cli version bump per hook, the same way `watchdog --install-service` ships systemd units as bundled data.
 
 ```bash
-swarph hooks init                 # install the recommended bundled set (cell-resilience)
-swarph hooks add cell-resilience  # install one builtin by name
-swarph hooks add ./my-hook        # install a local bundle dir (hook.json + script)
-swarph hooks list                 # builtins + install status (installed|available)
+swarph hooks init                    # install the recommended bundled set
+swarph hooks add codegraph-on-grep   # structural search alongside grep (see below)
+swarph hooks add cell-resilience     # install one builtin by name
+swarph hooks add ./my-hook           # install a local bundle dir (hook.json + script)
+swarph hooks list                    # builtins + install status (installed|available)
 swarph hooks remove cell-resilience
 ```
 
+**Bundled `codegraph-on-grep`** *(0.41.0)*. Binds `PostToolUse`/`Bash`. When a `grep`/`rg` searches
+**code**, it also queries the mesh gateway's structural codegraph and hands back the symbol-level
+answer — definitions, `file:line`, and **caller counts, which grep structurally cannot see**:
+
+```
+CODEGRAPH (structural, index 2.1h old) for 'def _board_grant' — grep found text; this is
+the symbol graph, incl. CALLER COUNTS grep cannot see:
+  mesh-gateway/server.py:1352  function _board_grant  callers=11
+```
+
+The point is **context cost**: a grep returning 200 matching lines is far more expensive than the
+handful of symbols that answer *"where is this defined and who calls it"*.
+
+- **It supplements grep; it never blocks it.** grep stays correct for config, logs and string
+  literals — the codegraph indexes *symbols*.
+- **An unavailable index is reported loudly, never as "no matches."** A failed lookup rendered as a
+  real negative teaches exactly the wrong thing, so the hook says so and marks the answer
+  unverified. A genuinely empty result from a *working* index says `a REAL negative` explicitly, and
+  a stale index reports its age.
+- **No local index required.** It asks the gateway, which scopes both rows and caller counts to your
+  visibility — resolved from your **bearer token**, never from a field you send, so it cannot be
+  self-asserted.
+
+Needs `SWARPH_SELF` (or `--as`), your peer token at `~/.config/swarph/<cell>.peer_token`, and a
+reachable gateway. Do not run a hand-rolled copy alongside it: two hooks per `Bash` call means two
+lookups, doubling the cost the hook exists to cut.
+
 **Trust model.** Three tiers: `builtin` (trusted, bundled with swarph-cli — installs without a prompt), `local` (a bundle dir you point at — shown then confirmed before any write), and `published`/`@cell/name` (**fails closed in v1** — never installs another cell's unreviewed code). Signed-publisher identity plus a publish-time security gate is the v2 model.
 
 **Bundled `cell-resilience`.** Binds `StopFailure`/`rate_limit` + `Stop`/`(all)` to a script that writes `$XDG_STATE_HOME/swarph/idle_since.json` (`{"session","reason","hook_event","ts"}`, `reason=throttle|normal`) — the push-side throttle detector the watchdog's `--dm-wake` can read instead of polling. Observational only: it never blocks the session and always exits 0 (jq if present, printf/sed fallback otherwise).
@@ -655,7 +682,7 @@ Dry-run is the default — nothing mutates without `--apply`. Cron-friendly exit
 | `8` | refused — not idempotent (second pass kept cutting; signal-eating alarm) |
 
 Design spec: `docs/superpowers/specs/2026-06-11-swarph-context-compressor-design.md`
-(in the hedge-fund-mcp repo).
+(in a private design repo; not published).
 
 ### `--json` mode semantics
 

{swarph_cli-0.41.0 → swarph_cli-0.41.1}/README.md

@@ -420,13 +420,41 @@ swarph watchdog --check --peer researcher --gateway http://localhost:8788 --dm-w
 Installs Claude Code hooks as **content** wired into `~/.claude/settings.json` — a hook becomes an installable artifact (a script + its event/matcher bindings merged into your settings) with no swarph-cli version bump per hook, the same way `watchdog --install-service` ships systemd units as bundled data.
 
 ```bash
-swarph hooks init                 # install the recommended bundled set (cell-resilience)
-swarph hooks add cell-resilience  # install one builtin by name
-swarph hooks add ./my-hook        # install a local bundle dir (hook.json + script)
-swarph hooks list                 # builtins + install status (installed|available)
+swarph hooks init                    # install the recommended bundled set
+swarph hooks add codegraph-on-grep   # structural search alongside grep (see below)
+swarph hooks add cell-resilience     # install one builtin by name
+swarph hooks add ./my-hook           # install a local bundle dir (hook.json + script)
+swarph hooks list                    # builtins + install status (installed|available)
 swarph hooks remove cell-resilience
 ```
 
+**Bundled `codegraph-on-grep`** *(0.41.0)*. Binds `PostToolUse`/`Bash`. When a `grep`/`rg` searches
+**code**, it also queries the mesh gateway's structural codegraph and hands back the symbol-level
+answer — definitions, `file:line`, and **caller counts, which grep structurally cannot see**:
+
+```
+CODEGRAPH (structural, index 2.1h old) for 'def _board_grant' — grep found text; this is
+the symbol graph, incl. CALLER COUNTS grep cannot see:
+  mesh-gateway/server.py:1352  function _board_grant  callers=11
+```
+
+The point is **context cost**: a grep returning 200 matching lines is far more expensive than the
+handful of symbols that answer *"where is this defined and who calls it"*.
+
+- **It supplements grep; it never blocks it.** grep stays correct for config, logs and string
+  literals — the codegraph indexes *symbols*.
+- **An unavailable index is reported loudly, never as "no matches."** A failed lookup rendered as a
+  real negative teaches exactly the wrong thing, so the hook says so and marks the answer
+  unverified. A genuinely empty result from a *working* index says `a REAL negative` explicitly, and
+  a stale index reports its age.
+- **No local index required.** It asks the gateway, which scopes both rows and caller counts to your
+  visibility — resolved from your **bearer token**, never from a field you send, so it cannot be
+  self-asserted.
+
+Needs `SWARPH_SELF` (or `--as`), your peer token at `~/.config/swarph/<cell>.peer_token`, and a
+reachable gateway. Do not run a hand-rolled copy alongside it: two hooks per `Bash` call means two
+lookups, doubling the cost the hook exists to cut.
+
 **Trust model.** Three tiers: `builtin` (trusted, bundled with swarph-cli — installs without a prompt), `local` (a bundle dir you point at — shown then confirmed before any write), and `published`/`@cell/name` (**fails closed in v1** — never installs another cell's unreviewed code). Signed-publisher identity plus a publish-time security gate is the v2 model.
 
 **Bundled `cell-resilience`.** Binds `StopFailure`/`rate_limit` + `Stop`/`(all)` to a script that writes `$XDG_STATE_HOME/swarph/idle_since.json` (`{"session","reason","hook_event","ts"}`, `reason=throttle|normal`) — the push-side throttle detector the watchdog's `--dm-wake` can read instead of polling. Observational only: it never blocks the session and always exits 0 (jq if present, printf/sed fallback otherwise).
@@ -608,7 +636,7 @@ Dry-run is the default — nothing mutates without `--apply`. Cron-friendly exit
 | `8` | refused — not idempotent (second pass kept cutting; signal-eating alarm) |
 
 Design spec: `docs/superpowers/specs/2026-06-11-swarph-context-compressor-design.md`
-(in the hedge-fund-mcp repo).
+(in a private design repo; not published).
 
 ### `--json` mode semantics
 

{swarph_cli-0.41.0 → swarph_cli-0.41.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "swarph-cli"
-version = "0.41.0"
+version = "0.41.1"
 description = "The `swarph` binary — a multi-LLM CLI and mesh-gateway client + bundled server (`swarph gateway`): one-shot prompts across providers, interactive `chat`, multi-provider `spawn` (claude/codex/antigravity via a ProviderMembrane with subprocess billing-scrub), `mesh` send/inbox/register, `brain-ask` over the swarph-brain (gbrain) semantic memory, git-backed `assisted_memory`, session `import`, and a stranded-session `watchdog`."
 readme = "README.md"
 license = { text = "MIT" }
@@ -51,7 +51,6 @@ dependencies = [
 Homepage = "https://github.com/BrainSurfing-tech/swarph-cli"
 Source = "https://github.com/BrainSurfing-tech/swarph-cli"
 Substrate = "https://github.com/BrainSurfing-tech/swarph-mesh"
-Spec = "https://github.com/darw007d/hedge-fund-mcp/blob/main/research/swarph_cli/PLAN.md"
 
 [project.optional-dependencies]
 dev = ["pytest>=7.0"]
@@ -111,4 +110,11 @@ swarph_cli = ["systemd/*.service", "systemd/*.timer", "systemd/*.default",
 
 [tool.pytest.ini_options]
 testpaths = ["tests"]
+# The tree must win over any installed copy. Without this, `pip install swarph-cli`
+# on the same box shadows src/ and the suite silently tests the PUBLISHED wheel
+# instead of your edits — every local change reads green whether or not it works.
+# Measured 2026-08-01: 1689 passed against site-packages vs 1690 against the tree;
+# the only test that noticed was a brand-new one, because the tree and 0.41.0 were
+# nearly identical. That agreement is a polluted baseline, not isolation.
+pythonpath = ["src"]
 addopts = "-v --tb=short"

{swarph_cli-0.41.0 → swarph_cli-0.41.1}/src/swarph_cli/__init__.py

@@ -16,6 +16,6 @@ The architecture splits CLI from substrate so:
 
 from __future__ import annotations
 
-__version__ = "0.41.0"
+__version__ = "0.41.1"
 
 __all__ = ["__version__"]

{swarph_cli-0.41.0 → swarph_cli-0.41.1}/src/swarph_cli/commands/codegraph_hook.py

@@ -152,6 +152,35 @@ def query_gateway(term: str, gateway: str, token: str, limit: int = MAX_ROWS) ->
         return {"error": f"{type(e).__name__}: {e}"}
 
 
+def _match_quality(term: str, rows: list) -> tuple:
+    """Did the results actually match what was ASKED, or only a common token?
+
+    >>> THE EMPTY ANSWER WAS MADE HONEST; THE NON-EMPTY ONE WAS NOT. <<<
+    (Reported first-hand by a peer, 2026-08-01.) The index's query sanitiser
+    OR-JOINS tokens, so `def command_beta_executor` matches anything containing
+    "command". He grepped a private-repo file and got six confident-looking
+    swarph-cli symbols WITH CALLER COUNTS — plausible structure from the wrong
+    repository, and caller counts make it read authoritative. His words: "the
+    failure mode you engineered out of the empty case walked back in through the
+    non-empty one."
+
+    So: find the query's DISTINCTIVE token — the longest content token, which is
+    the one carrying the intent (`command_beta_executor`, not `def`) — and check
+    whether ANY returned symbol name actually contains it. If none does, every
+    row is a common-token coincidence and must be labelled as such rather than
+    served as an answer.
+
+    Returns (distinctive_token, n_rows_matching_it).
+    """
+    toks = [t for t in re.findall(r"[A-Za-z0-9_]+", (term or "").lower())
+            if len(t) > 2 and t not in {"def", "class", "async", "the", "for"}]
+    if not toks:
+        return ("", len(rows))
+    key = max(toks, key=len)
+    hits = sum(1 for r in rows if key in str(r.get("name", "")).lower())
+    return (key, hits)
+
+
 def render(term: str, env: dict) -> str:
     """Format the envelope for injection. Errors are LOUD and named."""
     if "error" in env:
@@ -179,8 +208,18 @@ def render(term: str, env: dict) -> str:
             f"{r.get('kind')} {r.get('name')}  callers={r.get('callers')}"
             for r in rows[:MAX_ROWS]
         )
+    warn = ""
+    if rows:
+        key, hits = _match_quality(term, rows)
+        if key and hits == 0:
+            repos = sorted({str(r.get("repo")) for r in rows})
+            warn = (f"\n  >>> FUZZY MATCH — NOT AN ANSWER TO YOUR QUERY. No returned symbol's "
+                    f"name contains {key!r}. These matched a COMMON TOKEN only"
+                    + (f", and all are from: {', '.join(repos)}" if repos else "")
+                    + f". Treat them as unrelated: the symbol you grepped for is NOT in "
+                    f"what this index can see. <<<")
     return (f"CODEGRAPH (structural{age}) for '{term}' — grep found text; this is "
-            f"the symbol graph, incl. CALLER COUNTS grep cannot see:\n{body}\n\n"
+            f"the symbol graph, incl. CALLER COUNTS grep cannot see:\n{body}{warn}\n\n"
             f"Use this for definitions/callers/blast-radius. grep remains correct "
             f"for config, logs and string literals the codegraph does not index.")
 

{swarph_cli-0.41.0 → swarph_cli-0.41.1}/src/swarph_cli/gateway/server.py

@@ -76,7 +76,12 @@ PORT = int(os.environ.get("PORT", "8788"))
 # Gateway-held gbrain proxy token (POST /brain/query). Cells authenticate to
 # THIS gateway with their mesh token; the gateway then presents ITS OWN
 # gbrain token upstream so cells never need a separate gbrain_ credential.
-GATEWAY_GBRAIN_URL = os.environ.get("GATEWAY_GBRAIN_URL", "http://100.107.222.72:8792/mcp")
+# No default host. This shipped for 79 releases with a hardcoded PRIVATE TAILNET address as
+# its fallback, so every public install pointed at one operator's box unless the deployer
+# happened to set the variable. Unroutable from outside, so never an access hole — but it
+# disclosed topology, and a default that silently targets someone else's host is wrong even
+# when it cannot be reached. Unset now means UNCONFIGURED, which is the honest state.
+GATEWAY_GBRAIN_URL = os.environ.get("GATEWAY_GBRAIN_URL", "")
 GATEWAY_GBRAIN_TOKEN = os.environ.get("GATEWAY_GBRAIN_TOKEN", "")
 
 # B1 Meta-Edge identity (META_EDGE_IDENTITY_CONTRACT.md). Meta-Edge SSO ISSUES
@@ -4219,6 +4224,15 @@ def _brain_query_upstream(question: str, limit: int) -> list:
     """Proxy a READ-ONLY gbrain query. Builds the MCP `query` call itself (never
     write/admin), POSTs to GATEWAY_GBRAIN_URL with the gateway-held token, returns
     the chunk array. Raises on any upstream/parse failure (caller maps to 502)."""
+    if not GATEWAY_GBRAIN_URL:
+        # Named, not incidental. Removing the hardcoded default turned "unconfigured"
+        # into a reachable state for the first time, and an empty URL would otherwise
+        # surface as a urllib ValueError — a transport error for a CONFIGURATION fault,
+        # which sends the reader looking at the network instead of their env.
+        raise RuntimeError(
+            "GATEWAY_GBRAIN_URL is not set — the brain proxy is UNCONFIGURED, not "
+            "unreachable. Set it to your gbrain MCP endpoint. (Releases up to 0.41.0 "
+            "silently defaulted to one operator's private host; that default is gone.)")
     body = {"jsonrpc": "2.0", "id": 1, "method": "tools/call",
             "params": {"name": "query",
                        "arguments": {"query": question, "limit": limit, "expand": False}}}

{swarph_cli-0.41.0 → swarph_cli-0.41.1/src/swarph_cli.egg-info}/PKG-INFO

@@ -1,13 +1,12 @@
 Metadata-Version: 2.4
 Name: swarph-cli
-Version: 0.41.0
+Version: 0.41.1
 Summary: The `swarph` binary — a multi-LLM CLI and mesh-gateway client + bundled server (`swarph gateway`): one-shot prompts across providers, interactive `chat`, multi-provider `spawn` (claude/codex/antigravity via a ProviderMembrane with subprocess billing-scrub), `mesh` send/inbox/register, `brain-ask` over the swarph-brain (gbrain) semantic memory, git-backed `assisted_memory`, session `import`, and a stranded-session `watchdog`.
 Author: Pierre Samson, Claude Opus
 License: MIT
 Project-URL: Homepage, https://github.com/BrainSurfing-tech/swarph-cli
 Project-URL: Source, https://github.com/BrainSurfing-tech/swarph-cli
 Project-URL: Substrate, https://github.com/BrainSurfing-tech/swarph-mesh
-Project-URL: Spec, https://github.com/darw007d/hedge-fund-mcp/blob/main/research/swarph_cli/PLAN.md
 Keywords: swarph,llm,cli,mesh,gemini,claude,deepseek
 Classifier: Development Status :: 3 - Alpha
 Classifier: Environment :: Console
@@ -467,13 +466,41 @@ swarph watchdog --check --peer researcher --gateway http://localhost:8788 --dm-w
 Installs Claude Code hooks as **content** wired into `~/.claude/settings.json` — a hook becomes an installable artifact (a script + its event/matcher bindings merged into your settings) with no swarph-cli version bump per hook, the same way `watchdog --install-service` ships systemd units as bundled data.
 
 ```bash
-swarph hooks init                 # install the recommended bundled set (cell-resilience)
-swarph hooks add cell-resilience  # install one builtin by name
-swarph hooks add ./my-hook        # install a local bundle dir (hook.json + script)
-swarph hooks list                 # builtins + install status (installed|available)
+swarph hooks init                    # install the recommended bundled set
+swarph hooks add codegraph-on-grep   # structural search alongside grep (see below)
+swarph hooks add cell-resilience     # install one builtin by name
+swarph hooks add ./my-hook           # install a local bundle dir (hook.json + script)
+swarph hooks list                    # builtins + install status (installed|available)
 swarph hooks remove cell-resilience
 ```
 
+**Bundled `codegraph-on-grep`** *(0.41.0)*. Binds `PostToolUse`/`Bash`. When a `grep`/`rg` searches
+**code**, it also queries the mesh gateway's structural codegraph and hands back the symbol-level
+answer — definitions, `file:line`, and **caller counts, which grep structurally cannot see**:
+
+```
+CODEGRAPH (structural, index 2.1h old) for 'def _board_grant' — grep found text; this is
+the symbol graph, incl. CALLER COUNTS grep cannot see:
+  mesh-gateway/server.py:1352  function _board_grant  callers=11
+```
+
+The point is **context cost**: a grep returning 200 matching lines is far more expensive than the
+handful of symbols that answer *"where is this defined and who calls it"*.
+
+- **It supplements grep; it never blocks it.** grep stays correct for config, logs and string
+  literals — the codegraph indexes *symbols*.
+- **An unavailable index is reported loudly, never as "no matches."** A failed lookup rendered as a
+  real negative teaches exactly the wrong thing, so the hook says so and marks the answer
+  unverified. A genuinely empty result from a *working* index says `a REAL negative` explicitly, and
+  a stale index reports its age.
+- **No local index required.** It asks the gateway, which scopes both rows and caller counts to your
+  visibility — resolved from your **bearer token**, never from a field you send, so it cannot be
+  self-asserted.
+
+Needs `SWARPH_SELF` (or `--as`), your peer token at `~/.config/swarph/<cell>.peer_token`, and a
+reachable gateway. Do not run a hand-rolled copy alongside it: two hooks per `Bash` call means two
+lookups, doubling the cost the hook exists to cut.
+
 **Trust model.** Three tiers: `builtin` (trusted, bundled with swarph-cli — installs without a prompt), `local` (a bundle dir you point at — shown then confirmed before any write), and `published`/`@cell/name` (**fails closed in v1** — never installs another cell's unreviewed code). Signed-publisher identity plus a publish-time security gate is the v2 model.
 
 **Bundled `cell-resilience`.** Binds `StopFailure`/`rate_limit` + `Stop`/`(all)` to a script that writes `$XDG_STATE_HOME/swarph/idle_since.json` (`{"session","reason","hook_event","ts"}`, `reason=throttle|normal`) — the push-side throttle detector the watchdog's `--dm-wake` can read instead of polling. Observational only: it never blocks the session and always exits 0 (jq if present, printf/sed fallback otherwise).
@@ -655,7 +682,7 @@ Dry-run is the default — nothing mutates without `--apply`. Cron-friendly exit
 | `8` | refused — not idempotent (second pass kept cutting; signal-eating alarm) |
 
 Design spec: `docs/superpowers/specs/2026-06-11-swarph-context-compressor-design.md`
-(in the hedge-fund-mcp repo).
+(in a private design repo; not published).
 
 ### `--json` mode semantics
 

{swarph_cli-0.41.0 → swarph_cli-0.41.1}/tests/test_brain_ask_command.py

@@ -17,7 +17,7 @@ from swarph_cli.commands import brain_ask as ba
 
 def test_version_is_0_33_0():
     import swarph_cli
-    assert swarph_cli.__version__ == "0.41.0"
+    assert swarph_cli.__version__ == "0.41.1"
 
 
 # --- request / response plumbing -------------------------------------------

{swarph_cli-0.41.0 → swarph_cli-0.41.1}/tests/test_codegraph_hook.py

@@ -143,3 +143,51 @@ def test_the_hook_is_a_registered_builtin_bundle():
 def test_the_verb_is_registered():
     from swarph_cli.main import _VERB_HANDLERS  # noqa: PLC0415
     assert "codegraph-hook" in _VERB_HANDLERS
+
+
+# ── the non-empty answer must be as honest as the empty one ───────────────
+
+def test_a_FUZZY_match_is_labelled_not_served_as_an_answer():
+    """>>> a peer's first-hand receipt, 2026-08-01: the defect this closes. <<<
+
+    He grepped a private-repo file for `def command_beta_executor` and got six
+    swarph-cli symbols WITH CALLER COUNTS — the sanitiser OR-joins tokens, so it
+    matched "command". His diagnosis: "the failure mode you engineered out of the
+    empty case walked back in through the non-empty one." An empty answer said
+    "REAL negative"; a wrong answer said nothing at all.
+    """
+    env = {"results": [
+        {"repo": "swarph-cli", "file_path": "src/x.py", "start_line": 46,
+         "kind": "variable", "name": "_HOOK_COMMAND", "callers": 0},
+        {"repo": "swarph-cli", "file_path": "src/y.py", "start_line": 62,
+         "kind": "function", "name": "provider_command", "callers": 1},
+    ], "freshness": [{"index_age_hours": 1.6}]}
+    out = ch.render("def command_beta_executor", env)
+    assert "FUZZY MATCH" in out
+    assert "NOT AN ANSWER TO YOUR QUERY" in out
+    assert "command_beta_executor" in out
+    assert "swarph-cli" in out          # names the repo the strays came from
+
+
+def test_a_GENUINE_match_carries_no_fuzzy_warning():
+    """Non-vacuity pair. If the warning fired on real hits it would be noise, and
+    a warning that always fires is one nobody reads."""
+    env = {"results": [
+        {"repo": "service-repo", "file_path": "server.py", "start_line": 1352,
+         "kind": "function", "name": "_board_grant", "callers": 11},
+    ], "freshness": [{"index_age_hours": 2.0}]}
+    out = ch.render("_board_grant", env)
+    assert "FUZZY MATCH" not in out
+    assert "_board_grant" in out
+
+
+def test_a_PARTIAL_match_is_treated_as_genuine():
+    """One real hit among strays still answers the question — warn only when NOTHING
+    matches, or the signal degrades into noise."""
+    env = {"results": [
+        {"repo": "swarph-cli", "file_path": "a.py", "start_line": 1,
+         "kind": "variable", "name": "_HOOK_COMMAND", "callers": 0},
+        {"repo": "private-repo", "file_path": "workers/worker_beta.py",
+         "start_line": 900, "kind": "function", "name": "command_beta_executor", "callers": 3},
+    ], "freshness": [{"index_age_hours": 1.0}]}
+    assert "FUZZY MATCH" not in ch.render("def command_beta_executor", env)

{swarph_cli-0.41.0 → swarph_cli-0.41.1}/tests/test_gateway_brain.py

@@ -102,3 +102,36 @@ def test_upstream_helper_is_read_only_by_construction(monkeypatch):
     assert out == [{"slug": "s"}]
     assert captured["body"]["params"]["name"] == "query"          # read-only lock
     assert captured["auth"] == "Bearer gbrain_hostheld"           # gateway's held token
+
+
+def test_an_UNCONFIGURED_gbrain_url_names_itself_as_configuration_not_transport(monkeypatch):
+    """Releases up to 0.41.0 shipped a hardcoded PRIVATE TAILNET address as the
+    default for GATEWAY_GBRAIN_URL, so "unconfigured" was never a reachable state —
+    every install silently pointed at one operator's box.
+
+    Removing the default makes it reachable for the first time. An empty URL would
+    otherwise surface as a urllib ValueError: a TRANSPORT error for a CONFIGURATION
+    fault, which sends the reader to the network instead of their env.
+
+    Non-vacuity: this is the only test that exercises the empty branch. Every other
+    test in this file sets the variable in `_load_app`, which is exactly why the
+    hardcoded default survived 79 releases without a single test noticing it.
+    """
+    server = _load_app(monkeypatch)
+    monkeypatch.setattr(server, "GATEWAY_GBRAIN_URL", "")
+    with pytest.raises(RuntimeError) as e:
+        server._brain_query_upstream("anything", 5)
+    msg = str(e.value)
+    assert "UNCONFIGURED" in msg
+    assert "GATEWAY_GBRAIN_URL" in msg
+    assert "not" in msg and "unreachable" in msg   # names which fault it is NOT
+
+
+def test_a_CONFIGURED_url_does_not_raise_the_configuration_error(monkeypatch):
+    """Paired non-vacuity. If the guard fired on a configured gateway it would be a
+    regression, not a safety net — so the silent case is asserted too."""
+    server = _load_app(monkeypatch)
+    monkeypatch.setattr(server, "GATEWAY_GBRAIN_URL", "http://127.0.0.1:8792/mcp")
+    with pytest.raises(Exception) as e:      # noqa: PT011 — any transport failure is fine
+        server._brain_query_upstream("anything", 5)
+    assert "UNCONFIGURED" not in str(e.value)

{swarph_cli-0.41.0 → swarph_cli-0.41.1}/tests/test_watchdog.py

@@ -1043,4 +1043,4 @@ def test_parser_defaults_process_name_claude_liveness_cmd_none():
 
 def test_version_is_0_33_0():
     import swarph_cli
-    assert swarph_cli.__version__ == "0.41.0"
+    assert swarph_cli.__version__ == "0.41.1"