swarph-cli 0.68.2__tar.gz → 0.69.0__tar.gz

{swarph_cli-0.68.2/src/swarph_cli.egg-info → swarph_cli-0.69.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: swarph-cli
-Version: 0.68.2
+Version: 0.69.0
 Summary: The `swarph` binary — a multi-LLM CLI and mesh-gateway client + bundled server (`swarph gateway`): one-shot prompts across providers, interactive `chat`, multi-provider `spawn` (claude/codex/antigravity via a ProviderMembrane with subprocess billing-scrub), `mesh` send/inbox/register, `brain-ask` over the swarph-brain (gbrain) semantic memory, git-backed `assisted_memory`, per-invocation `gh` identity routing, a silent DM-wake hook, session `import`, and a stranded-session `watchdog`.
 Author: Pierre Samson, Claude Opus
 License: MIT

{swarph_cli-0.68.2 → swarph_cli-0.69.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "swarph-cli"
-version = "0.68.2"
+version = "0.69.0"
 description = "The `swarph` binary — a multi-LLM CLI and mesh-gateway client + bundled server (`swarph gateway`): one-shot prompts across providers, interactive `chat`, multi-provider `spawn` (claude/codex/antigravity via a ProviderMembrane with subprocess billing-scrub), `mesh` send/inbox/register, `brain-ask` over the swarph-brain (gbrain) semantic memory, git-backed `assisted_memory`, per-invocation `gh` identity routing, a silent DM-wake hook, session `import`, and a stranded-session `watchdog`."
 readme = "README.md"
 license = { text = "MIT" }

{swarph_cli-0.68.2 → swarph_cli-0.69.0}/src/swarph_cli/__init__.py

@@ -16,6 +16,6 @@ The architecture splits CLI from substrate so:
 
 from __future__ import annotations
 
-__version__ = "0.68.2"
+__version__ = "0.69.0"
 
 __all__ = ["__version__"]

{swarph_cli-0.68.2 → swarph_cli-0.69.0}/src/swarph_cli/channel.py

@@ -13,6 +13,7 @@ import threading
 import time
 from pathlib import Path
 
+from swarph_cli import identity
 from swarph_cli.dm_frame import FIRST_START_GRACE_S, created_within, frame_text, rows
 from swarph_cli.scripts.dm_notify_filter import is_real_dm
 
@@ -35,8 +36,8 @@ def channel_opted_in() -> bool:
 
 def channel_serves() -> bool:
     """Only the cell spawn named in SWARPH_CHANNEL_CELL may poll."""
-    self_name = os.environ.get("SWARPH_SELF") or ""
-    named = os.environ.get("SWARPH_CHANNEL_CELL") or ""
+    self_name = identity.declared(env=identity.SELF_ONLY)[0] or ""
+    named = (os.environ.get("SWARPH_CHANNEL_CELL") or "").strip()
     return channel_opted_in() and bool(named) and named == self_name
 
 
@@ -290,7 +291,7 @@ def serve(chan: Channel) -> None:
 
 
 def main(argv: list[str] | None = None) -> int:
-    cell = os.environ.get("SWARPH_SELF") or ""
+    cell = identity.declared(env=identity.SELF_ONLY)[0] or ""
     if not cell:
         print("swarph channel: SWARPH_SELF is unset; refusing to start", file=sys.stderr)
         return 2

{swarph_cli-0.68.2 → swarph_cli-0.69.0}/src/swarph_cli/commands/brain_ask.py

@@ -31,6 +31,7 @@ import os
 import sys
 import urllib.request
 
+from swarph_cli import identity
 from swarph_cli import tokens
 from pathlib import Path
 from typing import Optional
@@ -108,22 +109,27 @@ def _peer_token_path(self_name: str) -> Path:
     return Path.home() / ".config" / "swarph" / f"{self_name}.peer_token"
 
 
-# The fallback is ANOTHER CELL'S NAME. Harmless on lab-ovh, silently wrong everywhere
-# else — and it is what made the cold-env failure report a TOKEN fault: with SWARPH_SELF
-# unset the cell hunts lab-ovh.peer_token, finds nothing, and blames the credential.
-# MEASURED 2026-07-29 on 6 of 6 cells (droplet isolated it: adding ONLY the two env vars,
-# changing NO token, turned exit 2 into exit 0 at 1.00).
-# The default is KEPT (removing it would break callers that rely on it) and ANNOUNCED.
-_DEFAULT_SELF = "lab-ovh"
+# card #402: there is NO default identity. The old fallback was ANOTHER CELL'S NAME
+# ("lab-ovh"): harmless on lab-ovh, silently wrong everywhere else, and it made the
+# cold-env failure report a TOKEN fault (with SWARPH_SELF unset the cell hunted
+# lab-ovh.peer_token, found nothing and blamed the credential; measured 2026-07-29 on
+# 6 of 6 cells). An undeclared cell now does no peer-token lookup at all: brain reads
+# still work from GBRAIN_TOKEN / SWARPH_BRAIN_TOKEN / --token-file, and the gateway
+# path, which needs the cell's own peer token, refuses with the missing variable named.
+# The identity picks a CREDENTIAL file here, so this verb reads SWARPH_SELF (and its
+# legacy SWARPH_NODE alias) only, like the mesh verbs: an ambient SWARPH_CELL, which
+# psmux leaks from the spawning environment (#538), must not select another cell's
+# peer token.
+_IDENTITY_ENV = identity.SELF_ONLY + identity.NODE_ALIAS
 
 
-def _self_name() -> str:
-    return os.environ.get("SWARPH_SELF") or os.environ.get("SWARPH_NODE") or _DEFAULT_SELF
+def _self_name() -> Optional[str]:
+    return identity.declared(env=_IDENTITY_ENV)[0]
 
 
-def _self_name_is_defaulted() -> bool:
-    """True when no env named this cell and we fell back to _DEFAULT_SELF."""
-    return not (os.environ.get("SWARPH_SELF") or os.environ.get("SWARPH_NODE"))
+def _self_name_is_undeclared() -> bool:
+    """True when no flag or env names this cell. There is no fallback name."""
+    return _self_name() is None
 
 
 def env_diagnosis() -> str:
@@ -135,10 +141,9 @@ def env_diagnosis() -> str:
     a sourced profile, a bashrc or a settings.json `env` block never applies.
     """
     bits = []
-    if _self_name_is_defaulted():
-        bits.append(f"SWARPH_SELF unset — defaulting to {_DEFAULT_SELF!r}, which is "
-                    f"probably NOT this cell (so any peer-token lookup will hunt the "
-                    f"wrong file)")
+    if _self_name_is_undeclared():
+        bits.append("SWARPH_SELF unset — no cell identity is declared, so no peer-token "
+                    "lookup is attempted (there is no default identity; card #402)")
     if not os.environ.get("SWARPH_BRAIN_GATEWAY"):
         bits.append("SWARPH_BRAIN_GATEWAY unset — falling back to a direct brain "
                     "connection, which only works where the brain service is reachable "
@@ -167,8 +172,8 @@ def _resolve_token(token_file: Optional[str], self_name: str) -> Optional[str]:
     reviewing #190, and it is the sharpest kind of catch: I had noticed the
     hazard, written a comment about it, and not handled it.
 
-    `_self_name()` NEVER returns empty — it falls back to _DEFAULT_SELF
-    ("lab-ovh"). So `bool(self_name)` is always true here, and passing that as
+    `_self_name()` used to NEVER return empty — it fell back to a default peer
+    name ("lab-ovh"; removed by card #402). So `bool(self_name)` was always true, and passing that as
     identity_is_explicit would promote `lab-ovh.peer_token` — ANOTHER CELL'S
     CREDENTIAL — above GBRAIN_TOKEN on every invocation where nothing named the
     cell. The comment above already says why that fallback is dangerous
@@ -183,15 +188,15 @@ def _resolve_token(token_file: Optional[str], self_name: str) -> Optional[str]:
     rather than the resolver, because a unit test at the resolver cannot see
     what the caller makes reachable.
 
-    Explicitness therefore comes from `_self_name_is_defaulted()`, not from
-    truthiness: a guessed name keeps the old env-first order exactly, and only a
-    name the operator actually supplied earns precedence over ambient values.
+    Explicitness therefore comes from whether a name was DECLARED, not from
+    truthiness. Since card #402 nothing is ever guessed, so a declared name is
+    the only kind there is, and an undeclared cell gets the env-first order.
     """
     res = tokens.resolve_token(
         self_name or None,
         token_file,
         env_keys=("GBRAIN_TOKEN", "SWARPH_BRAIN_TOKEN"),
-        identity_is_explicit=bool(self_name) and not _self_name_is_defaulted(),
+        identity_is_explicit=self_name is not None,
     )
     return res.token if res is not None else None
 
@@ -262,6 +267,12 @@ def run_brain_ask(argv: list) -> int:
     gw = os.environ.get("SWARPH_BRAIN_GATEWAY")
     if gw:
         self_name = _self_name()
+        if self_name is None:
+            sys.stderr.write(env_diagnosis())
+            sys.stderr.write(
+                "swarph brain-ask: SWARPH_BRAIN_GATEWAY set but no cell identity is "
+                "declared, so there is no peer token to present (set SWARPH_SELF)\n")
+            return 2
         try:
             peer_token = _peer_token_path(self_name).read_text(encoding="utf-8").strip()
         except OSError:

{swarph_cli-0.68.2 → swarph_cli-0.69.0}/src/swarph_cli/commands/codegraph.py

@@ -34,6 +34,7 @@ import re
 import sqlite3
 import sys
 
+from swarph_cli import identity
 from swarph_cli.commands.codegraph_hook import _match_quality
 
 DEFAULT_INDEX = os.path.expanduser("~/.swarph/codegraph/index.db")
@@ -68,8 +69,8 @@ DEFAULT_INDEX = os.path.expanduser("~/.swarph/codegraph/index.db")
 IDENTITY_UNSET = object()  # sentinel: argparse default when --caller-cell is omitted
 
 
-class IdentityNotDeclared(RuntimeError):
-    """No caller identity was declared and there is no default to fall back to."""
+# card #402: one exception class for "nobody declared this cell", shared by every verb.
+IdentityNotDeclared = identity.IdentityNotDeclared
 
 
 def require_caller_cell(explicit=None, *, verb: str) -> str:
@@ -80,12 +81,10 @@ def require_caller_cell(explicit=None, *, verb: str) -> str:
     The refusal names the verb and every way to satisfy it, because an error that
     says only "identity unset" moves the work to the reader.
     """
-    if explicit not in (None, IDENTITY_UNSET) and str(explicit).strip():
-        return str(explicit).strip()
-    for var in ("SWARPH_SELF", "SWARPH_CELL"):
-        v = (os.environ.get(var) or "").strip()
-        if v:
-            return v
+    # card #402: the order lives in swarph_cli.identity, once, for every verb.
+    name, _ = identity.declared(None if explicit is IDENTITY_UNSET else explicit)
+    if name is not None:
+        return name
     raise IdentityNotDeclared(
         f"swarph {verb}: NO CALLER IDENTITY DECLARED, and there is no default.\n"
         f"  This used to fall back to 'lab-ovh', which meant an undeclared caller\n"

{swarph_cli-0.68.2 → swarph_cli-0.69.0}/src/swarph_cli/commands/codegraph_hook.py

@@ -33,6 +33,7 @@ import urllib.request
 from datetime import datetime, timezone
 from pathlib import Path
 from typing import Optional
+from swarph_cli import identity
 from swarph_cli.gateway_default import env_gateway
 
 TIMEOUT_S = 6
@@ -477,7 +478,7 @@ def supported_hook_events() -> frozenset:
 def run_codegraph_hook(argv: Optional[list] = None) -> int:
     """ALWAYS exits 0 — must never fail a turn."""
     argv = list(argv or [])
-    self_name = os.environ.get("SWARPH_SELF", "").strip()
+    self_name = identity.declared(env=identity.SELF_ONLY)[0] or ""
     gateway = env_gateway()
     for i, a in enumerate(argv):
         if a == "--as" and i + 1 < len(argv):

{swarph_cli-0.68.2 → swarph_cli-0.69.0}/src/swarph_cli/commands/daemon.py

@@ -49,6 +49,7 @@ from contextlib import suppress
 from pathlib import Path
 from typing import Optional
 
+from swarph_cli import identity
 from swarph_cli import session_bridge, stall_alert
 from swarph_cli.console_safe import print_safe
 from swarph_cli.delivery_queue import DeliveryQueue
@@ -115,18 +116,14 @@ def _build_parser() -> argparse.ArgumentParser:
 
 
 def _resolve_self_name(arg: Optional[str], state_dir: Path) -> str:
-    if arg:
-        return arg
-    env = os.environ.get("SWARPH_SELF")
-    if env:
-        return env
-    return state_dir.name
+    name, _ = identity.declared(arg, env=identity.SELF_ONLY)
+    return name if name is not None else state_dir.name
 
 
 def _resolve_state_dir(arg: Optional[str], self_name_arg: Optional[str]) -> Path:
     if arg:
         return Path(arg).expanduser()
-    self_name = self_name_arg or os.environ.get("SWARPH_SELF")
+    self_name = identity.declared(self_name_arg, env=identity.SELF_ONLY)[0]
     if self_name:
         return Path.home() / "swarph_state" / self_name
     # Last resort — a self_name is needed to disambiguate; surface error.
@@ -550,7 +547,7 @@ def run_daemon(argv: list[str]) -> int:
     args = _build_parser().parse_args(argv)
 
     # Resolve identity + state path
-    self_name = args.self_name or os.environ.get("SWARPH_SELF")
+    self_name = identity.declared(args.self_name, env=identity.SELF_ONLY)[0]
     if args.state_dir:
         state_dir = Path(args.state_dir).expanduser()
         if not self_name:

{swarph_cli-0.68.2 → swarph_cli-0.69.0}/src/swarph_cli/commands/gh_route.py

@@ -24,6 +24,7 @@ import os
 import sys
 from typing import Optional
 
+from swarph_cli import identity
 from swarph_cli import gh_identity as ghid
 from swarph_cli.cell import cells_dir
 from swarph_cli.console_safe import print_safe
@@ -69,7 +70,7 @@ def run_hook(stdin_text: Optional[str] = None) -> int:
         # The caller named a credential. #332: an explicit argument is a decision.
         return _allow_unchanged()
 
-    peer = os.environ.get("SWARPH_SELF", "").strip()
+    peer = identity.declared(env=identity.SELF_ONLY)[0] or ""
     try:
         res = ghid.resolve(peer or None)
     except ghid.RouterRefusal as exc:
@@ -93,7 +94,7 @@ def run_hook(stdin_text: Optional[str] = None) -> int:
 
 
 def run_show() -> int:
-    peer = os.environ.get("SWARPH_SELF", "").strip()
+    peer = identity.declared(env=identity.SELF_ONLY)[0] or ""
     try:
         res = ghid.resolve(peer or None)
     except ghid.RouterRefusal as exc:

{swarph_cli-0.68.2 → swarph_cli-0.69.0}/src/swarph_cli/commands/highlight.py

@@ -31,6 +31,7 @@ import sys
 from datetime import datetime, timezone
 from pathlib import Path
 
+from swarph_cli import identity
 from swarph_cli.commands.mesh import _post_json, _resolve_token
 from swarph_cli.timeline_paths import timeline_dir
 
@@ -177,7 +178,12 @@ def _log_via_gateway(gateway: str, cell: str, highlight: str,
     if memory:
         body["memory"] = memory
     try:
-        token = _resolve_token(cell, token_file)
+        # card #402: only a DECLARED identity may select its own peer token over the
+        # ambient one. A name guessed from git user.name or the hostname is
+        # attribution only: on a shared box it can be ANOTHER cell's name, and its
+        # peer token must not be presented as this caller's.
+        token = _resolve_token(cell, token_file,
+                               identity_is_explicit=cell_source in _DECLARED_SOURCES)
     except RuntimeError as exc:
         print(_credential_error(cell, cell_source, exc), file=sys.stderr)
         return 1
@@ -247,6 +253,10 @@ def _is_git_repo(repo: Path) -> bool:
     return r.returncode == 0 and r.stdout.strip() == "true"
 
 
+# Sources that DECLARE an identity (as opposed to guessing one), card #402.
+_DECLARED_SOURCES = ("--cell", "$SWARPH_SELF", "$SWARPH_CELL")
+
+
 def _resolve_cell(arg, repo: Path) -> tuple[str, str]:
     """Return ``(cell, source)``.
 
@@ -257,12 +267,9 @@ def _resolve_cell(arg, repo: Path) -> tuple[str, str]:
     """
     if arg:
         return _collapse(arg), "--cell"
-    self_env = os.environ.get("SWARPH_SELF")
-    if self_env:
-        return _collapse(self_env), "$SWARPH_SELF"
-    cell_env = os.environ.get("SWARPH_CELL")
-    if cell_env:
-        return _collapse(cell_env), "$SWARPH_CELL"
+    name, source = identity.declared()
+    if name is not None:
+        return _collapse(name), source
     if _is_git_repo(repo):
         r = _git(repo, "config", "user.name")
         if r.returncode == 0 and r.stdout.strip():

{swarph_cli-0.68.2 → swarph_cli-0.69.0}/src/swarph_cli/commands/hooks.py

@@ -47,6 +47,7 @@ import tempfile
 from dataclasses import dataclass
 from pathlib import Path
 
+from swarph_cli import identity
 from swarph_cli import __version__ as _SWARPH_CLI_VERSION
 
 # Placeholder substituted at install time into generated scripts (#830).
@@ -309,11 +310,7 @@ def touch_activity(argv: list[str] | None = None) -> int:
         from swarph_cli.cell import discover_cell_in_cwd, load_cell
         from swarph_cli.commands.watchdog import _resolve_activity_marker_path
 
-        role = (
-            os.environ.get("SWARPH_SELF")
-            or os.environ.get("SWARPH_CELL")
-            or "unidentified-cell"
-        )
+        role = identity.or_sentinel()
         cell_marker = None
         cell_path = discover_cell_in_cwd()
         if cell_path is not None:

{swarph_cli-0.68.2 → swarph_cli-0.69.0}/src/swarph_cli/commands/install_postcompact_hook.py

@@ -59,6 +59,7 @@ from importlib import resources
 from pathlib import Path
 from typing import Any, Optional
 
+from swarph_cli import identity
 from swarph_cli.cell import _atomic_write_text
 from swarph_cli.commands.hook_interpreter import hook_interpreter, refuse_unless_importable
 from swarph_cli.commands.install_wake_hook import _detect_harness
@@ -392,8 +393,7 @@ def run_install_postcompact_hook(argv: Optional[list[str]] = None) -> int:
         )
         return 2
 
-    cell = args.cell or os.environ.get("SWARPH_SELF") \
-        or os.environ.get("SWARPH_CELL") or None
+    cell = identity.declared(args.cell)[0]
     memory_dir: Optional[Path] = None
     if args.memory_dir:
         memory_dir = Path(os.path.expanduser(args.memory_dir))

{swarph_cli-0.68.2 → swarph_cli-0.69.0}/src/swarph_cli/commands/mcp_server.py

@@ -39,6 +39,7 @@ import os
 import urllib.error
 import urllib.request
 
+from swarph_cli import identity
 from swarph_cli.commands import add
 from swarph_cli.commands import codegraph
 from swarph_cli.commands import brain_ask, memory, timeline
@@ -152,7 +153,7 @@ def _codegraph_query(query: str, *, limit: int = 8) -> list[dict]:
     """Structural code search over the local codegraph index (Task 1).
 
     Delegates to :func:`codegraph.structural_query` against the module-level
-    ``_CODEGRAPH_INDEX`` path, using ``SWARPH_CELL`` (else
+    ``_CODEGRAPH_INDEX`` path, using the house identity order (``SWARPH_SELF``, then ``SWARPH_CELL``; else
     ``codegraph.require_caller_cell``, which REFUSES rather than defaulting) as
     the A8 caller identity and the
     default operate-what-you-own allowlist (``allowlist=None``).
@@ -170,8 +171,10 @@ def _codegraph_query(query: str, *, limit: int = 8) -> list[dict]:
         # authority. require_caller_cell raises IdentityNotDeclared, which the
         # NEVER-RAISES contract below turns into an empty result — FAIL-CLOSED: the
         # MCP host gets nothing rather than somebody else's answer.
-        caller_cell = codegraph.require_caller_cell(
-            os.environ.get("SWARPH_CELL"), verb="mcp codegraph_query")
+        # card #402: SWARPH_CELL used to be passed as the EXPLICIT identity here,
+        # so it outranked SWARPH_SELF, the CELL-first order #538 measured posting
+        # under another cell's name. The house order now decides.
+        caller_cell = codegraph.require_caller_cell(None, verb="mcp codegraph_query")
         rows = codegraph.structural_query(
             query,
             index_path=_CODEGRAPH_INDEX,

{swarph_cli-0.68.2 → swarph_cli-0.69.0}/src/swarph_cli/commands/memory.py

@@ -85,6 +85,11 @@ def _via_gateway(op: str, arguments: dict):
     if not gw:
         return False, None
     self_name = brain_ask._self_name()
+    if self_name is None:
+        # card #402: no default identity, so no peer token to present. OSError keeps
+        # run_memory's CLI fail-safe; the text names the variable to set.
+        raise OSError("SWARPH_BRAIN_GATEWAY is set but no cell identity is declared, "
+                      "so there is no peer token to present (set SWARPH_SELF)")
     peer_token = brain_ask._peer_token_path(self_name).read_text(encoding="utf-8").strip()
     return True, _gateway_call(gw, peer_token, op, arguments)
 

{swarph_cli-0.68.2 → swarph_cli-0.69.0}/src/swarph_cli/commands/memory_emit_hook.py

@@ -36,6 +36,7 @@ import tempfile
 from pathlib import Path
 from typing import Optional
 
+from swarph_cli import identity
 from swarph_cli.commands.highlight import _log_via_gateway, _resolve_gateway
 
 _SUPPRESS_WINDOW = dt.timedelta(minutes=30)
@@ -137,8 +138,14 @@ def _cell() -> str:
     # leaks SWARPH_CELL from the spawning environment, so a CELL-first order
     # posts this cell's highlight under ANOTHER cell's name and token
     # (measured by cursor-win on the Windows membrane, 2026-08-22).
-    return (os.environ.get("SWARPH_SELF") or os.environ.get("SWARPH_CELL")
-            or socket.gethostname())
+    return _cell_with_source()[0]
+
+
+def _cell_with_source() -> tuple:
+    name, source = identity.declared()
+    if name is not None:
+        return name, source
+    return socket.gethostname(), "hostname"
 
 
 def run_memory_emit_hook(argv: list[str] | None = None) -> int:
@@ -167,7 +174,9 @@ def run_memory_emit_hook(argv: list[str] | None = None) -> int:
         gateway = _resolve_gateway(None)
         if not gateway:
             return 0  # no gateway configured -> nowhere to emit; silent by design
-        rc = _log_via_gateway(gateway, _cell(), text, f"[[{slug}]]", None, None)
+        cell, cell_source = _cell_with_source()
+        rc = _log_via_gateway(gateway, cell, text, f"[[{slug}]]", None, None,
+                              cell_source=cell_source)
         if rc == 0:
             _mark_emitted(slug)
     except Exception:

{swarph_cli-0.68.2 → swarph_cli-0.69.0}/src/swarph_cli/commands/mesh.py

@@ -31,6 +31,7 @@ import urllib.error
 import urllib.parse
 import uuid
 
+from swarph_cli import identity
 import swarph_cli
 import urllib.request
 from collections import deque
@@ -301,11 +302,9 @@ def _resolve_self_name(
     *,
     state_dir: Optional[Path] = None,
 ) -> str:
-    if arg:
-        return arg
-    env = os.environ.get("SWARPH_SELF")
-    if env:
-        return env
+    name, _ = identity.declared(arg, env=identity.SELF_ONLY)
+    if name is not None:
+        return name
     if state_dir is not None:
         return state_dir.name
     raise RuntimeError("cannot resolve self identity; pass --as or set SWARPH_SELF")
@@ -323,11 +322,9 @@ def _resolve_self_with_source(arg: Optional[str]) -> tuple:
     Reading consumes, so an unlucky first command marks another peer's queue read,
     silently, exit 0. Same family as board #360 (identity fails TOWARD lab-ovh).
     """
-    if arg:
-        return arg, "--as"
-    env = os.environ.get("SWARPH_SELF")
-    if env:
-        return env, "$SWARPH_SELF"
+    name, source = identity.declared(arg, env=identity.SELF_ONLY)
+    if name is not None:
+        return name, ("--as" if source == "flag" else source)
     raise RuntimeError("cannot resolve self identity; pass --as or set SWARPH_SELF")
 
 

{swarph_cli-0.68.2 → swarph_cli-0.69.0}/src/swarph_cli/commands/monitor.py

@@ -44,6 +44,7 @@ import sys
 import time
 from pathlib import Path
 
+from swarph_cli import identity
 from swarph_cli.gateway_default import env_gateway
 
 from . import mesh
@@ -359,7 +360,7 @@ def _self_name_was_derived(args: argparse.Namespace) -> bool:
     That is the dangerous path: `--as` and $SWARPH_SELF are deliberate, a
     directory name is incidental.
     """
-    return not args.self_name and not os.environ.get("SWARPH_SELF")
+    return identity.declared(args.self_name, env=identity.SELF_ONLY)[0] is None
 
 
 def _verify_self_is_registered(self_name, gateway, token):

{swarph_cli-0.68.2 → swarph_cli-0.69.0}/src/swarph_cli/commands/onboard.py

@@ -33,6 +33,7 @@ import urllib.request
 from getpass import getpass
 from pathlib import Path
 from typing import Optional
+from swarph_cli import identity
 from swarph_cli import tokens
 from swarph_cli.console_safe import print_safe
 from swarph_cli.gateway_default import env_gateway, require_gateway
@@ -294,7 +295,7 @@ def _resolve_token(token_file_arg: Optional[str], *,
     # Limited to "SWARPH_SELF is set", so an operator who names no cell is
     # unaffected and #243's additivity guarantee survives for that population.
     env_tok = os.environ.get("MESH_GATEWAY_TOKEN")
-    self_name = os.environ.get("SWARPH_SELF", "").strip()
+    self_name = identity.declared(env=identity.SELF_ONLY)[0] or ""
     # Set when a per-peer credential was found but is not usable for THIS target
     # (#467b). Distinguishes "you have the WRONG credential" from "you have NO
     # credential" at the refusal below — two different operator problems, and
@@ -387,7 +388,7 @@ def _resolve_token(token_file_arg: Optional[str], *,
     #
     # Placed AFTER the existing two so a working operator-token setup is
     # unchanged; this only fills the hole where the verb used to prompt.
-    self_name = os.environ.get("SWARPH_SELF", "").strip()
+    self_name = identity.declared(env=identity.SELF_ONLY)[0] or ""
     if self_name:
         peer_tok = Path.home() / ".config" / "swarph" / f"{self_name}.peer_token"
         if peer_tok.exists():
@@ -887,7 +888,7 @@ def run_onboard(argv: list[str]) -> int:
     # swarph onboard`. Defer there leaves the first cells with no
     # credential — they cannot use the tools. Detected only when GET
     # /peers is readable; a failed read keeps established-mesh defer.
-    cell_context = os.environ.get("SWARPH_SELF", "").strip() == canonical
+    cell_context = identity.declared(env=identity.SELF_ONLY)[0] == canonical
     rstatus, rpayload = _get_json(f"{args.gateway}/peers", token)
     bootstrap_window = _registry_is_bootstrap_window(rstatus, rpayload)
     defer_mint = (not cell_context) and (not bootstrap_window)

{swarph_cli-0.68.2 → swarph_cli-0.69.0}/src/swarph_cli/commands/wake_hook_output.py

@@ -33,6 +33,7 @@ import sys
 from pathlib import Path
 from typing import Any, Optional
 
+from swarph_cli import identity
 from swarph_cli.cell import (
     CellError,
     cells_dir,
@@ -187,7 +188,7 @@ def _resolve_cell(explicit: Optional[str] = None) -> tuple[Optional[str], str]:
         return name, source
     if explicit:
         return explicit, "install-time --cell"
-    env_self = os.environ.get("SWARPH_SELF", "").strip()
+    env_self = identity.declared(env=identity.SELF_ONLY)[0] or ""
     if env_self:
         return env_self, "$SWARPH_SELF"
     cwd_local = discover_cell_in_cwd()

{swarph_cli-0.68.2 → swarph_cli-0.69.0}/src/swarph_cli/commands/watchdog.py

@@ -77,6 +77,7 @@ import urllib.request
 from datetime import datetime, timedelta, timezone
 from pathlib import Path
 from typing import Optional
+from swarph_cli import identity
 from swarph_cli.gateway_default import env_gateway
 
 from swarph_cli.commands.mesh import _post_json
@@ -1886,6 +1887,12 @@ def run_install_service(args: argparse.Namespace) -> int:
     """
     files = _bundled_systemd_files()
     cell = args.cell
+    if cell == identity.SENTINEL:
+        # card #402: an install is not a turn, so there is no reason to fall back.
+        # Units named after the sentinel would supervise nobody, permanently.
+        print("swarph watchdog --install-service: no cell identity declared. "
+              "Pass --cell <cell> or set SWARPH_SELF.", file=sys.stderr)
+        return 4
 
     # v0.10.1: units are PER-CELL — swarph-watchdog-<cell>.{service,timer} +
     # /etc/default/swarph-watchdog-<cell> — so a multi-cell host runs one
@@ -2044,11 +2051,7 @@ def _build_parser() -> argparse.ArgumentParser:
     )
     p.add_argument(
         "--cell",
-        default=(
-            os.environ.get("SWARPH_SELF")
-            or os.environ.get("SWARPH_CELL")
-            or "unidentified-cell"
-        ),
+        default=identity.or_sentinel(),
     )
     p.add_argument("--cursor", default=None)
     p.add_argument(

{swarph_cli-0.68.2 → swarph_cli-0.69.0}/src/swarph_cli/gateway/server.py

@@ -1076,6 +1076,17 @@ async def peers_register(req: PeerRegisterRequest,
     name. capabilities dict is the JSON snapshot from claude-service /health.
     """
     ctx = _authorize(authorization)
+    # #472: bind the caller to the name it registers. Without this, any
+    # per-peer-authenticated caller could register ANY name and be handed a
+    # freshly minted credential for it. Ported from the deployed gateway
+    # (mesh-gateway #467b/#108), same field and site names so both trees'
+    # telemetry agrees: UNCONDITIONAL (never gated on predicting whether a
+    # mint will happen; #467b's race) and OUTSIDE the transaction below
+    # (_check_caller_binding writes telemetry on its own connection, which
+    # would wait out the busy timeout against a held write lock; #108).
+    # The shared token stays unbound (C2's documented no-op; closure is C5).
+    _check_caller_binding(ctx, req.name, field="register_mint_target",
+                          site="peers_register_mint")
     # B2 owner-stamping (META_EDGE_IDENTITY_CONTRACT.md §Cell-join). A Meta-Edge
     # principal ties the registered cell to its owner (the node-in-your-tailnet
     # relationship); lab principals (shared/commander/per-peer token) leave owner