swarph-cli 0.72.20__tar.gz → 0.72.22__tar.gz

{swarph_cli-0.72.20/src/swarph_cli.egg-info → swarph_cli-0.72.22}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: swarph-cli
-Version: 0.72.20
+Version: 0.72.22
 Summary: The `swarph` binary — a multi-LLM CLI and mesh-gateway client + bundled server (`swarph gateway`): one-shot prompts across providers, interactive `chat`, multi-provider `spawn` (claude/codex/antigravity via a ProviderMembrane with subprocess billing-scrub), `mesh` send/inbox/register, `brain-ask` over the swarph-brain (gbrain) semantic memory, git-backed `assisted_memory`, per-invocation `gh` identity routing, a silent DM-wake hook, session `import`, and a stranded-session `watchdog`.
 Author: Pierre Samson, Claude Opus
 License: MIT

{swarph_cli-0.72.20 → swarph_cli-0.72.22}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "swarph-cli"
-version = "0.72.20"
+version = "0.72.22"
 description = "The `swarph` binary — a multi-LLM CLI and mesh-gateway client + bundled server (`swarph gateway`): one-shot prompts across providers, interactive `chat`, multi-provider `spawn` (claude/codex/antigravity via a ProviderMembrane with subprocess billing-scrub), `mesh` send/inbox/register, `brain-ask` over the swarph-brain (gbrain) semantic memory, git-backed `assisted_memory`, per-invocation `gh` identity routing, a silent DM-wake hook, session `import`, and a stranded-session `watchdog`."
 readme = "README.md"
 license = { text = "MIT" }
@@ -153,7 +153,7 @@ where = ["src"]
 # installed 0.72.13 failed 'owner map unreadable' while the tree passed.
 # test_1073_wheel_install builds the wheel and runs the installed copy.
 swarph_cli = ["systemd/*.service", "systemd/*.timer", "systemd/*.default",
-              "systemd/*.path",
+              "systemd/*.path", "launchd/*.plist",
               "scripts/*.sh", "scripts/*.ps1", "guide/*.md",
               "payloads/postcompact/*.sh", "payloads/postcompact/*.cmd",
               "payloads/opencode/*.js",

{swarph_cli-0.72.20 → swarph_cli-0.72.22}/src/swarph_cli/__init__.py

@@ -16,6 +16,6 @@ The architecture splits CLI from substrate so:
 
 from __future__ import annotations
 
-__version__ = "0.72.20"
+__version__ = "0.72.22"
 
 __all__ = ["__version__"]

{swarph_cli-0.72.20 → swarph_cli-0.72.22}/src/swarph_cli/commands/board.py

@@ -1013,6 +1013,7 @@ def _build_parser() -> argparse.ArgumentParser:
     ct = cards.add_parser("thread", help="show the card's conversation (#181: a card IS a thread)")
     ct.add_argument("id", type=int)
     ct.add_argument("--limit", type=int, default=None, help="max messages (gateway caps at 1000)")
+    ct.add_argument("--json", action="store_true")
     _add_common(ct)
     cy = cards.add_parser("say", help="post a message onto the card's thread")
     cy.add_argument("id", type=int)

{swarph_cli-0.72.20 → swarph_cli-0.72.22}/src/swarph_cli/commands/gh_route.py

@@ -75,6 +75,12 @@ def run_hook(stdin_text: Optional[str] = None) -> int:
         res = ghid.resolve(peer or None)
     except ghid.RouterRefusal as exc:
         return _deny(str(exc))
+    except Exception as exc:
+        # >>> A CRASHED RESOLVER MUST DENY, NOT EXIT NON-ZERO. <<< Claude Code blocks a
+        # PreToolUse call only on exit 2 or a deny; any other failure lets `gh` run as
+        # the active account (#360). drop-on-meta-edge measured it on #1818.
+        return _deny(f"the identity resolver crashed, so no identity was resolved: "
+                     f"{type(exc).__name__}: {exc}")
 
     rewritten = ghid.inject(command, res.login)
     updated = dict(payload.get("tool_input") or {})
@@ -97,7 +103,7 @@ def run_show() -> int:
     peer = identity.declared(env=identity.SELF_ONLY)[0] or ""
     try:
         res = ghid.resolve(peer or None)
-    except ghid.RouterRefusal as exc:
+    except Exception as exc:  # RouterRefusal, or a resolver crash: both are "no identity"
         print_safe(f"swarph gh-route: REFUSED\n  {exc}", file=sys.stderr)
         return 1
     print_safe(f"cell        {res.peer}")
@@ -145,7 +151,7 @@ def _cells_on_this_box() -> list:
         try:
             doc = yaml.safe_load(f.read_text(encoding="utf-8")) or {}
             name = doc.get("name") if isinstance(doc, dict) else None
-        except OSError as exc:
+        except (OSError, UnicodeDecodeError, RecursionError) as exc:
             # >>> AN UNREADABLE CONFIG IS NOT A CELL NAMED AFTER ITS FILE. <<< The first
             # version's docstring promised this distinction and the CODE DID NOT MAKE IT:
             # OSError and no-name-found both set name=None and both fell through to
@@ -169,6 +175,25 @@ def _cells_on_this_box() -> list:
     return sorted(out)
 
 
+def _any_yaml_login() -> bool:
+    """True when at least one cell yaml on this box carries a ``github:`` value. With no
+    json AND no yaml login the router is unconfigured, not merely incomplete."""
+    import yaml  # local import — keeps `swarph --version` PyYAML-free (cell.py:254)
+
+    try:
+        files = sorted(cells_dir().glob("*.yaml"))
+    except OSError:
+        return False
+    for f in files:
+        try:
+            doc = yaml.safe_load(f.read_text(encoding="utf-8")) or {}
+        except Exception:
+            continue
+        if isinstance(doc, dict) and doc.get(ghid.YAML_KEY):
+            return True
+    return False
+
+
 def run_doctor() -> int:
     """Would installing the router REFUSE anyone on this box? Answer BEFORE installing.
 
@@ -185,9 +210,20 @@ def run_doctor() -> int:
     every command that mentions one inside a string.
 
     Exit 0 only when every cell on this box resolves. Non-zero is "do not install yet".
+
+    #1144: each cell is checked through ``ghid.resolve`` — THE SAME CALL THE HOOK MAKES —
+    so a yaml-mapped cell reads ok and a yaml/json disagreement reads REFUSED here
+    exactly as it would at the first `gh` call. A preflight that loads the json itself
+    asks a different question than the hook, the defect _cells_on_this_box records.
     """
+    mp = ghid.mapping_path()
     try:
-        table = ghid.load_mapping()
+        if mp.exists():
+            ghid.load_mapping(mp)        # an UNREADABLE json refuses every cell: say so once
+        elif not _any_yaml_login():
+            raise ghid.RouterRefusal(
+                f"no GitHub identity mapping at {mp}, and no cell yaml under "
+                f"{cells_dir()} carries '{ghid.YAML_KEY}:'.")
     except ghid.RouterRefusal as exc:
         print_safe(
             f"swarph gh-route doctor: REFUSED\n  {exc}\n"
@@ -209,12 +245,19 @@ def run_doctor() -> int:
             file=sys.stderr)
         return 1
 
-    unmapped = [c for c in cells if not isinstance(table.get(c), str) or not table.get(c)]
+    unmapped = []
     for c in cells:
-        login = table.get(c)
-        ok = isinstance(login, str) and login
-        print(f"  {'ok     ' if ok else 'REFUSED'}  {c} -> {login if ok else '(unmapped)'}")
-    print(f"\nmapping: {ghid.mapping_path()}")
+        try:
+            res = ghid.resolve(c, cells=cells_dir())
+        except ghid.RouterRefusal as exc:
+            unmapped.append(c)
+            why = str(exc).splitlines()[0]
+            print_safe(f"  REFUSED  {c} -> (unmapped)  [{why}]")
+            continue
+        where = "yaml" if res.source.endswith(".yaml") else "json"
+        print_safe(f"  ok       {c} -> {res.login}  [{where}: {res.source}]")
+    print(f"\ncell yamls: {cells_dir()}  (read first, key '{ghid.YAML_KEY}:')")
+    print(f"mapping:    {mp}  (fallback, retiring)")
     if unmapped:
         print(f">>> {len(unmapped)} of {len(cells)} cells on this box would be REFUSED: "
               f"{', '.join(unmapped)}")

{swarph_cli-0.72.20 → swarph_cli-0.72.22}/src/swarph_cli/commands/init.py

@@ -23,6 +23,7 @@ import yaml
 from swarph_shared.cell import PEER_NAME_RE, parse_cell_dict
 from swarph_cli.cell import CLI_ENABLED_PROVIDERS, CellError, cells_dir
 from swarph_cli.gateway_default import env_gateway
+from swarph_cli.gh_identity import LOGIN_RE
 
 _CODEX_SANDBOX_DEFAULT = "workspace-write"
 _CODEX_SANDBOX_VALUES = ("workspace-write", "read-only")
@@ -68,6 +69,7 @@ def _llm_choices() -> list:
 # Prompt helpers (interactive). All no-op when a flag already supplied the value.
 # ---------------------------------------------------------------------------
 
+
 def _ask(prompt: str, default: Optional[str] = None) -> str:
     suffix = f" [{default}]" if default else ""
     try:
@@ -134,6 +136,9 @@ def _build_parser() -> argparse.ArgumentParser:
     p.add_argument("--assisted-memory", dest="assisted_memory", default=None, metavar="REPO",
                    help="enable git-backed memory at REPO (SSH→HTTPS normalized)")
     p.add_argument("--starter", default=None)
+    p.add_argument("--github", default=None, metavar="LOGIN",
+                   help="GitHub login gh-route injects for this cell (#1144). No default: "
+                        "without it the cell is refused by gh-route where the hook is installed")
     p.add_argument("--symlink-cwd", dest="symlink_cwd", action="store_true")
     p.add_argument("--force", action="store_true")
     p.add_argument("--non-interactive", "-y", dest="non_interactive", action="store_true",
@@ -209,6 +214,21 @@ def run_init(argv: list[str]) -> int:
     if args.starter:
         cell["starter_prompt_path"] = args.starter
 
+    # ── GitHub login (#1144) ──
+    # >>> NO DEFAULT, AND NEVER THE ACTIVE `gh` ACCOUNT. <<< A login filled from
+    # `gh auth status` makes the cell act as whoever happens to be logged in, which is
+    # the #360 substitution gh-route refuses. Blank stays blank; gh-route then refuses
+    # the cell, and the line below says so at creation instead of at its first push.
+    github = (args.github or "").strip()
+    if not github and interactive:
+        github = _ask("GitHub login this cell acts as (blank = none yet)").strip()
+    if github:
+        if not LOGIN_RE.fullmatch(github):
+            print(f"swarph init: --github {github!r} is not a valid GitHub login",
+                  file=sys.stderr)
+            return 2
+        cell["github"] = github
+
     # ── assisted memory (y/n) ──
     am_repo = args.assisted_memory
     if am_repo is None and interactive and _ask_yn("Use assisted memory (git-backed durable memory)?", False):
@@ -254,6 +274,12 @@ def run_init(argv: list[str]) -> int:
     print(f"    tmux_session={cell['tmux_session']}  cursor_path={cell['cursor_path']}")
     if "assisted_memory" in cell:
         print(f"    assisted_memory.repo={cell['assisted_memory']['repo']} (enabled)")
+    if "github" in cell:
+        print(f"    github={cell['github']}")
+    else:
+        print(f"    github=(none) — >>> gh-route will REFUSE every `gh` call from {name} "
+              f"once its hook is installed on this box. <<< Set it by adding "
+              f"`github: <login>` to {dest}.")
 
     # Registration is NOT done here (R1 token mint-once is a once-only secret —
     # init scaffolding from the operator's context shouldn't capture another

{swarph_cli-0.72.20 → swarph_cli-0.72.22}/src/swarph_cli/commands/mesh.py

@@ -3535,7 +3535,8 @@ def _monitor_deliver(state: MonitorState) -> None:
                 from swarph_cli import stall_alert
                 if stall_alert.is_alert_tick(ticks):
                     stall_alert.send_stall_alert(
-                        state.gateway, state.token, state.self_name, ticks, len(dms)
+                        state.gateway, state.token, state.self_name, ticks,
+                        stall_alert.pending_count(dms, state.self_name)
                     )
                 changed = True
                 # #1010: name the deferral's real cause — a hardcoded

{swarph_cli-0.72.20 → swarph_cli-0.72.22}/src/swarph_cli/commands/spawn.py

@@ -3065,6 +3065,10 @@ def _opencode_env(cell: Cell) -> dict[str, str]:
     # an operator's own disable would otherwise be lost, not preserved).
     env["OPENCODE_DISABLE_CLAUDE_CODE"] = "1"
     env["OPENCODE_DISABLE_EXTERNAL_SKILLS"] = "1"
+    # $HOME is shared, but gh does not use it unless GH_CONFIG_DIR is set.
+    # Keep a parent value; otherwise point the cell at $HOME/.config/gh.
+    if "GH_CONFIG_DIR" not in env:
+        env["GH_CONFIG_DIR"] = str(Path.home() / ".config" / "gh")
     # NOTE (2026-09-16, probe): the plugin's `experimental.chat.system.transform`
     # fires WITHOUT the OPENCODE_EXPERIMENTAL umbrella (measured on 1.18.30), so
     # we do NOT set it — widening the experimental surface for a flag the hook

{swarph_cli-0.72.20 → swarph_cli-0.72.22}/src/swarph_cli/gh_identity.py

@@ -24,12 +24,29 @@ consistent, so no server-side control can fire.
 THE MAPPING IS OPERATOR DATA, NOT SHIPPED DATA. A wrong mapping is a silent identity
 substitution, so this module ships NO defaults and NO built-in table: an absent or
 incomplete mapping is a REFUSAL, never a guess.
+
+#1144 — THE CELL CARRIES ITS OWN LOGIN. A cell's yaml (``github: <login>``) is read
+FIRST; ``gh-identities.json`` is the fallback for one release and is then retired. The
+commander, 2026-10-14: "you are all suppose to have that identity in your cell yaml".
+The json held 2 cells for two months while the rest were refused at their first push
+(#1096), days after they were created. A field set at ``swarph init`` puts the gap at
+creation instead.
+
+>>> A CELL IS FOUND BY ITS ``name:``, NEVER BY ITS FILENAME. <<< ``lab.yaml`` carries
+``name: lab-ovh``, and SWARPH_SELF is the mesh name — the same split ``gh-route doctor``
+was fixed for (_cells_on_this_box).
+
+>>> YAML AND JSON DISAGREEING IS A REFUSAL, NOT "YAML WINS". <<< During the fallback
+release both can name a login for one cell. Picking either silently is the identity
+substitution this module exists to end, one layer up; the operator decides which is
+right and deletes the other.
 """
 from __future__ import annotations
 
 import json
 import os
 import re
+import shlex
 from dataclasses import dataclass
 from pathlib import Path
 from typing import Optional
@@ -119,14 +136,87 @@ def load_mapping(path: Optional[Path] = None) -> dict:
     try:
         data = json.loads(p.read_text(encoding="utf-8"))
     except Exception as exc:
-        raise RouterRefusal(f"GitHub identity mapping at {p} is unreadable: {exc}")
+        raise RouterRefusal(f"GitHub identity mapping at {p} is unreadable: {exc}. "
+                            f"Fix it, or delete it if every cell's yaml carries '{YAML_KEY}:'.")
     if not isinstance(data, dict):
         raise RouterRefusal(f"GitHub identity mapping at {p} must be a JSON object")
     return data
 
 
-def resolve(peer: Optional[str], path: Optional[Path] = None) -> Resolution:
-    """peer -> Resolution, or RouterRefusal. Never returns a fallback."""
+#: The cell-yaml key that names the cell's GitHub login (#1144).
+YAML_KEY = "github"
+
+#: GitHub's login grammar. The login is spliced into the hook's shell command, so a
+#: value outside it is refused, never quoted-and-hoped (#1144 security review).
+LOGIN_RE = re.compile(r"[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}")
+
+
+def _checked(peer: str, login: str, source) -> "Resolution":
+    if not LOGIN_RE.fullmatch(login):
+        raise RouterRefusal(
+            f"{source}: GitHub login for {peer!r} is not a valid GitHub login: {login!r}")
+    return Resolution(peer=peer, login=login, source=str(source))
+
+
+def _cells_dir() -> Path:
+    from swarph_cli.cell import cells_dir  # local: cell.py is the one owner of the path
+    return cells_dir()
+
+
+def yaml_claims(peer: str, directory: Optional[Path] = None, key: str = YAML_KEY):
+    """Every cell yaml that declares mesh name ``peer`` -> ``([(value, path)], unreadable)``.
+
+    ``key`` names the yaml key to read (default ``github``; stall_alert reads
+    ``responsible``, card #1135) so there is ONE yaml reader, not two.
+    ``value`` is the raw value (None when the file has no such key), so the
+    caller can tell "no yaml for this cell" from "a yaml that maps nothing". A file with
+    no ``name:`` is the cell named by its stem — the same rule as _cells_on_this_box.
+    ``unreadable`` lists files that could not be parsed: they may be this cell, so a
+    refusal names them rather than reading as "not mapped".
+    """
+    import yaml  # local import — keeps `swarph --version` PyYAML-free (cell.py:254)
+
+    d = directory or _cells_dir()
+    claims, unreadable = [], []
+    try:
+        files = sorted(d.glob("*.yaml"))
+    except OSError:
+        return claims, unreadable
+    for f in files:
+        try:
+            doc = yaml.safe_load(f.read_text(encoding="utf-8")) or {}
+        except Exception:
+            # Not just OSError/YAMLError: a UTF-16 file (a PowerShell 5.1 redirect) raises
+            # UnicodeDecodeError and deep nesting raises RecursionError. Either escaping
+            # here crashed the hook, and a crashed hook lets `gh` run as the active
+            # account (#360) for every cell on the box (drop-on-meta-edge, #1818).
+            unreadable.append(f)
+            continue
+        if not isinstance(doc, dict):
+            unreadable.append(f)
+            continue
+        name = doc.get("name")
+        if (name if isinstance(name, str) and name else f.stem) == peer:
+            claims.append((doc.get(key), f))
+    return claims, unreadable
+
+
+def _optional_mapping(path: Optional[Path]) -> Optional[dict]:
+    """The json table, or None when the file is ABSENT. Absent is now a normal state
+    (the yaml carries the login); an UNREADABLE file still refuses via load_mapping."""
+    p = path or mapping_path()
+    if not p.exists():
+        return None
+    return load_mapping(p)
+
+
+def resolve(peer: Optional[str], path: Optional[Path] = None,
+            cells: Optional[Path] = None) -> Resolution:
+    """peer -> Resolution, or RouterRefusal. Never returns a fallback.
+
+    Order (#1144): the cell's yaml ``github:``, then gh-identities.json. Both present
+    and different is a refusal.
+    """
     if not peer:
         raise RouterRefusal(
             "SWARPH_SELF is unset, so this cell has no mesh identity to route from.\n"
@@ -135,21 +225,69 @@ def resolve(peer: Optional[str], path: Optional[Path] = None) -> Resolution:
             "  6 of 6 cells (#243) and the direct cause of #360.\n"
             "  Set SWARPH_SELF, or pass GH_TOKEN=... explicitly for a one-off."
         )
-    table = load_mapping(path)
+    claims, unreadable = yaml_claims(peer, cells)
+    mapped = [(v, f) for v, f in claims if v is not None]
+    for v, f in mapped:
+        if not isinstance(v, str) or not v.strip():
+            raise RouterRefusal(
+                f"{f}: '{YAML_KEY}:' for {peer!r} must be a non-empty string, "
+                f"got {v!r}")
+    yaml_logins = sorted({v.strip() for v, _ in mapped})
+    if len(yaml_logins) > 1:
+        # Two configs claiming one mesh name with different logins: either could be
+        # the live one, and picking is a guess.
+        raise RouterRefusal(
+            f"cell {peer!r} is claimed by {len(mapped)} cell yamls with different "
+            f"GitHub logins:\n"
+            + "".join(f"    {f}: {YAML_KEY}: {v}\n" for v, f in mapped)
+            + "  >>> REFUSING RATHER THAN PICKING ONE. <<< Keep one config per cell.")
+
+    p = path or mapping_path()
+    if yaml_logins:
+        table = _optional_mapping(path) or {}
+        jl = table.get(peer)
+        if jl is not None and jl != yaml_logins[0]:
+            raise RouterRefusal(
+                f"cell {peer!r} has two GitHub identities that disagree:\n"
+                f"    {mapped[0][1]}: {YAML_KEY}: {yaml_logins[0]}\n"
+                f"    {p}: {jl!r}\n"
+                f"  >>> REFUSING RATHER THAN LETTING EITHER WIN. <<< The yaml is the\n"
+                f"  source of truth from #1144 on: fix whichever is wrong, then delete\n"
+                f"  {peer!r} from {p.name}.")
+        return _checked(peer, yaml_logins[0], mapped[0][1])
+
+    table = _optional_mapping(path)
+    if table is None:
+        raise RouterRefusal(
+            f"cell {peer!r} has no '{YAML_KEY}:' in its cell yaml under {cells or _cells_dir()},\n"
+            f"  and there is no GitHub identity mapping at {p} either.\n"
+            f"  The router refuses rather than using whichever `gh` account happens\n"
+            f"  to be active — an ambient identity is how a cell runs for days as\n"
+            f"  another cell (#360) with every request internally consistent.\n"
+            f"  Add `{YAML_KEY}: <github-login>` to the cell's yaml"
+            f" (`swarph init --github` writes it).\n"
+            + _unreadable_note(unreadable))
     login = table.get(peer)
     if not login:
-        p = path or mapping_path()
         raise RouterRefusal(
-            f"cell {peer!r} has no GitHub identity in {p}.\n"
-            f"  Known cells: {', '.join(sorted(table)) or '(none)'}\n"
+            f"cell {peer!r} has no GitHub identity: no '{YAML_KEY}:' in its cell yaml"
+            f" under {cells or _cells_dir()}, and none in {p}.\n"
+            f"  Known cells in {p.name}: {', '.join(sorted(table)) or '(none)'}\n"
             f"  >>> REFUSING RATHER THAN USING THE ACTIVE ACCOUNT. <<< Falling back\n"
             f"  would attribute {peer}'s action to whoever is logged in, and GitHub's\n"
             f"  own gates key on the CREDENTIAL, not on who did the work.\n"
-            f"  Add \"{peer}\": \"<github-login>\" to that file, or pass GH_TOKEN=... explicitly."
-        )
+            f"  Add `{YAML_KEY}: <github-login>` to the cell's yaml, or pass GH_TOKEN=... explicitly.\n"
+            + _unreadable_note(unreadable))
     if not isinstance(login, str):
         raise RouterRefusal(f"mapping for {peer!r} must be a string, got {type(login).__name__}")
-    return Resolution(peer=peer, login=login, source=str(path or mapping_path()))
+    return _checked(peer, login, p)
+
+
+def _unreadable_note(unreadable) -> str:
+    if not unreadable:
+        return ""
+    return ("  NOT READ (may be this cell's config): "
+            + ", ".join(str(f) for f in unreadable) + "\n")
 
 
 def targets_gh(command: str) -> bool:
@@ -195,4 +333,4 @@ def inject(command: str, login: str) -> str:
     per-invocation property wanted — it is not `gh auth switch`, and it touches no
     global state and no other session.
     """
-    return f'export GH_TOKEN=$(gh auth token --user {login}); {command}'
+    return f'export GH_TOKEN=$(gh auth token --user {shlex.quote(login)}); {command}'

swarph_cli-0.72.22/src/swarph_cli/launchd/swarph-codex-outbox.plist

@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<!-- card #1195. Rendered from systemd/swarph-codex-outbox@.service by launchd_render.py. Do not edit by hand. -->
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>tech.brainsurfing.swarph.codex-outbox.__PEER__</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>__SWARPH_BIN__</string>
+    <string>codex-waker</string>
+    <string>--drain-outbox</string>
+    <string>--self</string>
+    <string>__PEER__</string>
+    <string>--state-dir</string>
+    <string>__SWARPH_WAKER_STATE_DIR__</string>
+    <string>--cwd</string>
+    <string>__SWARPH_WAKER_CWD__</string>
+    <string>--outbox-dir</string>
+    <string>__SWARPH_OUTBOX_DIR__</string>
+    <string>--gateway</string>
+    <string>__SWARPH_GATEWAY__</string>
+    <string>--token-file</string>
+    <string>__SWARPH_TOKEN_FILE__</string>
+  </array>
+  <key>RunAtLoad</key>
+  <false/>
+  <key>StandardOutPath</key>
+  <string>__LOG_DIR__/launchd.out.log</string>
+  <key>StandardErrorPath</key>
+  <string>__LOG_DIR__/launchd.err.log</string>
+</dict>
+</plist>

swarph_cli-0.72.22/src/swarph_cli/launchd/swarph-codex-outbox.timer.plist

@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<!-- card #1195. Rendered from systemd/swarph-codex-outbox@.service + systemd/swarph-codex-outbox@.timer by launchd_render.py. Do not edit by hand. -->
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>tech.brainsurfing.swarph.codex-outbox.timer.__PEER__</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>__SWARPH_BIN__</string>
+    <string>codex-waker</string>
+    <string>--drain-outbox</string>
+    <string>--self</string>
+    <string>__PEER__</string>
+    <string>--state-dir</string>
+    <string>__SWARPH_WAKER_STATE_DIR__</string>
+    <string>--cwd</string>
+    <string>__SWARPH_WAKER_CWD__</string>
+    <string>--outbox-dir</string>
+    <string>__SWARPH_OUTBOX_DIR__</string>
+    <string>--gateway</string>
+    <string>__SWARPH_GATEWAY__</string>
+    <string>--token-file</string>
+    <string>__SWARPH_TOKEN_FILE__</string>
+  </array>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>StartInterval</key>
+  <integer>15</integer>
+  <key>StandardOutPath</key>
+  <string>__LOG_DIR__/launchd.out.log</string>
+  <key>StandardErrorPath</key>
+  <string>__LOG_DIR__/launchd.err.log</string>
+</dict>
+</plist>

swarph_cli-0.72.22/src/swarph_cli/launchd/swarph-monitor.plist

@@ -0,0 +1,39 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<!-- card #1195. Rendered from systemd/swarph-monitor@.service by launchd_render.py. Do not edit by hand. -->
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>tech.brainsurfing.swarph.monitor.__PEER__</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>__SWARPH_BIN__</string>
+    <string>monitor</string>
+    <string>start</string>
+    <string>--as</string>
+    <string>__PEER__</string>
+    <string>--deliver</string>
+    <string>pull</string>
+    <string>--foreground</string>
+  </array>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <true/>
+  <key>ThrottleInterval</key>
+  <integer>10</integer>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>SWARPH_SELF</key>
+    <string>__PEER__</string>
+    <key>HOME</key>
+    <string>__HOME__</string>
+    <key>MESH_GATEWAY_URL</key>
+    <string>__GATEWAY__</string>
+  </dict>
+  <key>StandardOutPath</key>
+  <string>__LOG_DIR__/launchd.out.log</string>
+  <key>StandardErrorPath</key>
+  <string>__LOG_DIR__/launchd.err.log</string>
+</dict>
+</plist>

swarph_cli-0.72.22/src/swarph_cli/launchd/swarph-watchdog.plist

@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<!-- card #1195. Rendered from systemd/swarph-watchdog.service by launchd_render.py. Do not edit by hand. -->
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>tech.brainsurfing.swarph.watchdog</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>__SWARPH_BIN__</string>
+    <string>watchdog</string>
+    <string>--check</string>
+  </array>
+  <key>RunAtLoad</key>
+  <false/>
+  <key>StandardOutPath</key>
+  <string>__LOG_DIR__/launchd.out.log</string>
+  <key>StandardErrorPath</key>
+  <string>__LOG_DIR__/launchd.err.log</string>
+</dict>
+</plist>

swarph_cli-0.72.22/src/swarph_cli/launchd/swarph-watchdog.timer.plist

@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<!-- card #1195. Rendered from systemd/swarph-watchdog.service + systemd/swarph-watchdog.timer by launchd_render.py. Do not edit by hand. -->
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>tech.brainsurfing.swarph.watchdog.timer</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>__SWARPH_BIN__</string>
+    <string>watchdog</string>
+    <string>--check</string>
+  </array>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>StartInterval</key>
+  <integer>300</integer>
+  <key>StandardOutPath</key>
+  <string>__LOG_DIR__/launchd.out.log</string>
+  <key>StandardErrorPath</key>
+  <string>__LOG_DIR__/launchd.err.log</string>
+</dict>
+</plist>