swarph-cli 0.53.1__tar.gz → 0.53.2__tar.gz

{swarph_cli-0.53.1/src/swarph_cli.egg-info → swarph_cli-0.53.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: swarph-cli
-Version: 0.53.1
+Version: 0.53.2
 Summary: The `swarph` binary — a multi-LLM CLI and mesh-gateway client + bundled server (`swarph gateway`): one-shot prompts across providers, interactive `chat`, multi-provider `spawn` (claude/codex/antigravity via a ProviderMembrane with subprocess billing-scrub), `mesh` send/inbox/register, `brain-ask` over the swarph-brain (gbrain) semantic memory, git-backed `assisted_memory`, per-invocation `gh` identity routing, a silent DM-wake hook, session `import`, and a stranded-session `watchdog`.
 Author: Pierre Samson, Claude Opus
 License: MIT

{swarph_cli-0.53.1 → swarph_cli-0.53.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "swarph-cli"
-version = "0.53.1"
+version = "0.53.2"
 description = "The `swarph` binary — a multi-LLM CLI and mesh-gateway client + bundled server (`swarph gateway`): one-shot prompts across providers, interactive `chat`, multi-provider `spawn` (claude/codex/antigravity via a ProviderMembrane with subprocess billing-scrub), `mesh` send/inbox/register, `brain-ask` over the swarph-brain (gbrain) semantic memory, git-backed `assisted_memory`, per-invocation `gh` identity routing, a silent DM-wake hook, session `import`, and a stranded-session `watchdog`."
 readme = "README.md"
 license = { text = "MIT" }

{swarph_cli-0.53.1 → swarph_cli-0.53.2}/src/swarph_cli/__init__.py

@@ -16,6 +16,6 @@ The architecture splits CLI from substrate so:
 
 from __future__ import annotations
 
-__version__ = "0.53.1"
+__version__ = "0.53.2"
 
 __all__ = ["__version__"]

swarph_cli-0.53.2/src/swarph_cli/systemd/swarph-monitor-reexec.service

@@ -0,0 +1,50 @@
+[Unit]
+# #654: the oneshot the .path unit fires. Runs `swarph monitor reexec-on-change`,
+# which restarts each UNIT-OWNED swarph-monitor@<peer> instance — serially with a
+# stagger (R3: eight simultaneous restarts put the whole box's DM path down at
+# once), skipping instances with a recorded reexec hold (R4: a deliberate hold is
+# a correct engineering decision, not drift), reporting every action to the
+# journal (R5), and naming the cells it cannot reach — tmux-scoped monitors are
+# OUT OF SCOPE and must be reported, not omitted (R6).
+#
+# R7: THE RE-EXEC MUST SURVIVE THE INSTALL THAT TRIGGERS IT.
+# `pipx install --force` closes site-packages/__init__.py (PathChanged fires)
+# BEFORE it restores ~/.local/bin/swarph. Measured 2026-08-30 on lab-ovh:
+#   __init__.py mtime 11:31:27Z  -> PathChanged
+#   ~/.local/bin/swarph 11:33:27Z -> shim back
+#   shim absent ~120s (one box, one install — treat as a FLOOR, not a constant)
+# A 203/EXEC fails instantly, so each Restart= cycle costs only RestartSec.
+# Coverage of the gap is therefore (StartLimitBurst - 1) * RestartSec:
+#   RestartSec=15, StartLimitBurst=17  -> last retry at 240s (>= 2x measured floor)
+# StartLimitIntervalSec must EXCEED that span so the burst is not reset mid-gap
+# (interval > coverage); after coverage the cap terminates a permanent miss.
+# Restart=on-failure (not always — refused for Type=oneshot on systemd 259).
+# A touch on the watched file never reproduces this race: shim stays put.
+#
+# LOUD FAILURE (R5 extended): a permanently failed oneshot must reach an
+# operator. Do NOT bake a box-local alerter into this template — mercury-alert@
+# exists on lab-ovh and not everywhere. Add a drop-in, e.g.
+#   OnFailure=mercury-alert@%n.service
+# or the box's equivalent, when installing. The Restart= below closes the race;
+# the drop-in closes the silence if retries exhaust.
+#
+# Runs as root: restarting system units owned by the cells' user requires it.
+# The oneshot itself executes the NEWLY-INSTALLED code — it starts after the
+# install completed, which is exactly the code the fleet is being moved to.
+Description=Re-exec supervised swarph monitors after a swarph-cli reinstall (#654)
+Documentation=https://github.com/BrainSurfing-tech/swarph-cli
+# Cap retries after full gap coverage — see R7 derivation above.
+# Interval (300) > coverage span (240) so the burst is not refreshed mid-gap.
+StartLimitIntervalSec=300
+StartLimitBurst=17
+
+[Service]
+Type=oneshot
+# Default oneshot timeout is 90s. Nine stale monitors at the verb's 15s
+# stagger is 135s — PID1 kills the job mid-fleet if we inherit it.
+TimeoutStartSec=5min
+# systemd 230+: Restart=always|on-success are refused for Type=oneshot;
+# Restart=on-failure is accepted (verified systemd-analyze verify on 259).
+Restart=on-failure
+RestartSec=15
+ExecStart=<SWARPH_BIN> monitor reexec-on-change --apply --state-root <STATE_ROOT>

{swarph_cli-0.53.1 → swarph_cli-0.53.2/src/swarph_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: swarph-cli
-Version: 0.53.1
+Version: 0.53.2
 Summary: The `swarph` binary — a multi-LLM CLI and mesh-gateway client + bundled server (`swarph gateway`): one-shot prompts across providers, interactive `chat`, multi-provider `spawn` (claude/codex/antigravity via a ProviderMembrane with subprocess billing-scrub), `mesh` send/inbox/register, `brain-ask` over the swarph-brain (gbrain) semantic memory, git-backed `assisted_memory`, per-invocation `gh` identity routing, a silent DM-wake hook, session `import`, and a stranded-session `watchdog`.
 Author: Pierre Samson, Claude Opus
 License: MIT

{swarph_cli-0.53.1 → swarph_cli-0.53.2}/tests/test_654_reexec.py

@@ -19,10 +19,15 @@ The requirements as tests:
       the new build.
   R6  monitors systemd does not own (tmux-scoped, hand-started) are NAMED
       out of scope, never omitted.
-
-The live accept legs (touch the watched file on a real box; a held cell
-stays; the report names the tmux-scoped two) run against the installed
-unit — commander-gated. These tests guard everything short of systemd.
+  R7  the oneshot must survive the install that triggers it: pipx deletes
+      ~/.local/bin/swarph between closing __init__.py (PathChanged) and
+      restoring the shim. Restart=on-failure + RestartSec retries a 203/EXEC
+      into the healed state. A touch-based green does NOT prove R7.
+
+The live accept legs (real `pipx install --force` on a real box; a held cell
+stays; the report names the tmux-scoped two; a forced 203 is loud) run
+against the installed unit — commander-gated. These tests guard everything
+short of systemd.
 """
 
 from __future__ import annotations
@@ -112,6 +117,51 @@ def test_oneshot_timeout_outlasts_a_full_fleet_stagger():
     assert seconds >= 180, f"{raw!r} is still shorter than a full-fleet stagger"
 
 
+def test_oneshot_retries_through_the_pipx_shim_race():
+    """R7: PathChanged fires when pipx closes __init__.py, BEFORE the
+    ~/.local/bin/swarph shim is restored. Without Restart=on-failure the
+    oneshot dies 203/EXEC once and the .path unit stays green while the
+    fleet stays stale (lab-ovh 2026-08-30). Restart=always is refused for
+    Type=oneshot — on-failure is the legal retry.
+
+    A 203/EXEC fails instantly, so coverage is (Burst-1)*RestartSec. The
+    measured shim gap on lab-ovh was ~120s; drop's review pins coverage
+    >= 240s (2x floor) and Interval > that span so the limit is not reset
+    mid-gap. Presence of the keys alone is not enough — arithmetic must hold.
+    """
+    text = monitor._read_packaged(("systemd", "swarph-monitor-reexec.service"))
+    assert "Type=oneshot" in text
+    restarts = [ln for ln in text.splitlines() if ln.startswith("Restart=")]
+    assert restarts == ["Restart=on-failure"], restarts
+
+    def _sec(key: str) -> float:
+        lines = [ln for ln in text.splitlines() if ln.startswith(f"{key}=")]
+        assert lines, f"{key}= missing"
+        raw = lines[0].split("=", 1)[1].strip().lower()
+        if raw.endswith("min"):
+            return float(raw[:-3]) * 60
+        return float(raw.rstrip("s"))
+
+    restart_sec = _sec("RestartSec")
+    burst_lines = [ln for ln in text.splitlines() if ln.startswith("StartLimitBurst=")]
+    assert burst_lines, "StartLimitBurst= missing"
+    burst = int(burst_lines[0].split("=", 1)[1].strip())
+    interval = _sec("StartLimitIntervalSec")
+    coverage = (burst - 1) * restart_sec
+    assert coverage >= 240, (
+        f"retry coverage {coverage}s = ({burst}-1)*{restart_sec}s is shorter "
+        f"than the 240s floor (2x the measured 120s shim gap)")
+    assert interval > coverage, (
+        f"StartLimitIntervalSec={interval} must exceed coverage span {coverage} "
+        f"or the burst resets mid-gap and never terminates")
+    # Box-local alerters (mercury-alert@) must NOT be baked into the template
+    # as a live directive (a comment naming the drop-in pattern is fine).
+    live = [ln for ln in text.splitlines()
+            if ln.startswith("OnFailure=")]
+    assert not live, (
+        f"OnFailure= couples every install to one box's alerter — use a drop-in: {live}")
+
+
 def test_path_unit_uses_pathchanged_never_pathmodified():
     text = monitor._read_packaged(("systemd", "swarph-monitor-reexec.path"))
     directives = [line for line in text.splitlines()

swarph_cli-0.53.1/src/swarph_cli/systemd/swarph-monitor-reexec.service

@@ -1,22 +0,0 @@
-[Unit]
-# #654: the oneshot the .path unit fires. Runs `swarph monitor reexec-on-change`,
-# which restarts each UNIT-OWNED swarph-monitor@<peer> instance — serially with a
-# stagger (R3: eight simultaneous restarts put the whole box's DM path down at
-# once), skipping instances with a recorded reexec hold (R4: a deliberate hold is
-# a correct engineering decision, not drift), reporting every action to the
-# journal (R5), and naming the cells it cannot reach — tmux-scoped monitors are
-# OUT OF SCOPE and must be reported, not omitted (R6).
-#
-# Runs as root: restarting system units owned by the cells' user requires it.
-# The oneshot itself executes the NEWLY-INSTALLED code — it starts after the
-# install completed, which is exactly the code the fleet is being moved to.
-Description=Re-exec supervised swarph monitors after a swarph-cli reinstall (#654)
-Documentation=https://github.com/BrainSurfing-tech/swarph-cli
-# After the path unit fires; nothing else to order against.
-
-[Service]
-Type=oneshot
-# Default oneshot timeout is 90s. Nine stale monitors at the verb's 15s
-# stagger is 135s — PID1 kills the job mid-fleet if we inherit it.
-TimeoutStartSec=5min
-ExecStart=<SWARPH_BIN> monitor reexec-on-change --apply --state-root <STATE_ROOT>