swarph-cli 0.72.39__tar.gz → 0.72.41__tar.gz

{swarph_cli-0.72.39/src/swarph_cli.egg-info → swarph_cli-0.72.41}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: swarph-cli
-Version: 0.72.39
+Version: 0.72.41
 Summary: The `swarph` binary — a multi-LLM CLI and mesh-gateway client + bundled server (`swarph gateway`): one-shot prompts across providers, interactive `chat`, multi-provider `spawn` (claude/codex/antigravity via a ProviderMembrane with subprocess billing-scrub), `mesh` send/inbox/register, `brain-ask` over the swarph-brain (gbrain) semantic memory, git-backed `assisted_memory`, per-invocation `gh` identity routing, a silent DM-wake hook, session `import`, and a stranded-session `watchdog`.
 Author: Pierre Samson, Claude Opus
 License: MIT

{swarph_cli-0.72.39 → swarph_cli-0.72.41}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "swarph-cli"
-version = "0.72.39"
+version = "0.72.41"
 description = "The `swarph` binary — a multi-LLM CLI and mesh-gateway client + bundled server (`swarph gateway`): one-shot prompts across providers, interactive `chat`, multi-provider `spawn` (claude/codex/antigravity via a ProviderMembrane with subprocess billing-scrub), `mesh` send/inbox/register, `brain-ask` over the swarph-brain (gbrain) semantic memory, git-backed `assisted_memory`, per-invocation `gh` identity routing, a silent DM-wake hook, session `import`, and a stranded-session `watchdog`."
 readme = "README.md"
 license = { text = "MIT" }

{swarph_cli-0.72.39 → swarph_cli-0.72.41}/src/swarph_cli/__init__.py

@@ -16,6 +16,6 @@ The architecture splits CLI from substrate so:
 
 from __future__ import annotations
 
-__version__ = "0.72.39"
+__version__ = "0.72.41"
 
 __all__ = ["__version__"]

{swarph_cli-0.72.39 → swarph_cli-0.72.41}/src/swarph_cli/commands/board.py

@@ -41,6 +41,7 @@ from swarph_cli.commands.mesh import (
     _http_get_json,
     _post_json,
     _resolve_self_name,
+    _resolve_self_with_source,
     _resolve_token,
 )
 from swarph_cli.redact import redact_text, redact_value, encode_outbound_json
@@ -509,6 +510,105 @@ def _thread_recipient(
     )
 
 
+def _peer_grants_url(gw: str, peer: str) -> str:
+    return (f"{gw.rstrip('/')}/peers/"
+            f"{urllib.parse.quote(peer, safe='')}/grants")
+
+
+# Level rank shared with the gateway's RBAC union (server._GRANT_LEVEL_RANK):
+# only used to pick the best matching grant for the why-line, never for
+# the entitlement decision itself.
+_DEV_EXTRACT_GRANT_RANK = {"member": 1, "read": 1, "propose": 2, "write": 2,
+                           "execute": 3, "admin": 4}
+
+
+def _dev_extract_entitlement(gw: str, token: str, self_name: str,
+                             project_slug: str) -> tuple:
+    """Runner entitlement for dev-extract private rows (card #1410 rework).
+
+    Exactly ONE ``GET /peers/{peer}/grants`` per run. Entitled only when a
+    row with ``grant_type == "board"``, ``target == project_slug``,
+    ``level == "execute"`` AND ``direct is True`` is present — the runner's
+    OWN direct execute grant (exact grantee match). A ``'*'`` grantee row or
+    a group-inherited execute grant never counts, even though the live
+    gateway's ``POST /authz/check`` effective verdict reports both with
+    ``via_group None`` (``'*'`` row) or ``via_group ALL`` over direct
+    (best-level tie) — reading that verdict was the F1/F2 defect.
+    Returns ``(entitled, best_level, best_via, state)`` with ``state`` one of
+    ``"ok"`` / ``"unavailable"`` (bad status/body) / ``"unreachable"``
+    (transport failure); anything but ``"ok"`` fails closed, never open.
+    """
+    try:
+        st, data = _http_get_json(_peer_grants_url(gw, self_name), token)
+    except Exception:
+        return False, None, None, "unreachable"
+    if st == 0:
+        return False, None, None, "unreachable"
+    if not (st and 200 <= st < 300) or not isinstance(data, dict):
+        return False, None, None, "unavailable"
+    grants = data.get("grants")
+    if not isinstance(grants, list):
+        return False, None, None, "unavailable"
+    rows = [g for g in grants
+            if isinstance(g, dict)
+            and g.get("grant_type") == "board"
+            and g.get("target") == project_slug]
+    entitled = any(g.get("level") == "execute" and g.get("direct") is True
+                   for g in rows)
+    best = None
+    for g in rows:
+        if (best is None or _DEV_EXTRACT_GRANT_RANK.get(g.get("level"), 0)
+                > _DEV_EXTRACT_GRANT_RANK.get(best.get("level"), 0)):
+            best = g
+    if best is None:
+        return entitled, None, None, "ok"
+    via = best.get("via_group")
+    if not (isinstance(via, str) and via):
+        via = "direct" if best.get("direct") is True else "wide"
+    return entitled, best.get("level"), via, "ok"
+
+
+def _dev_extract_privacy_line(card, project_slug, entitled: bool,
+                              level, via, state: str,
+                              runner: str = "?", source: str = "?",
+                              gw_unreachable: bool = False) -> str:
+    """The one plain private-rows line for a dev-extract run (card #1410).
+
+    Names the runner (name + where the identity came from) and the actual
+    reason: shown on the runner's own direct execute grant, else the
+    missing direct grant with the best matching board grant beside it (a
+    best ``level=execute`` there is group/wide, never the runner's own —
+    the line never claims otherwise), an unreachable or unavailable grant
+    check, an unresolvable project, or no card at all. Carries no repo
+    names, so it is safe on every path (print, post, --json stderr).
+    """
+    who = f"runner {runner} via {source}"
+    if card is None:
+        if gw_unreachable:
+            return ("private rows: withheld "
+                    "(gateway unreachable, so no project grant to check)")
+        return "private rows: withheld (no card, so no project grant to check)"
+    if not project_slug:
+        return ("private rows: withheld (project unresolvable, "
+                "so no project grant to check)")
+    if entitled:
+        return (f"private rows: shown for project {project_slug} "
+                f"({who}: direct execute grant; repos from card-allowlist)")
+    if state == "unreachable":
+        return (f"private rows: withheld for project {project_slug} "
+                f"({who}: gateway unreachable, so no grant to check)")
+    if state != "ok":
+        return (f"private rows: withheld for project {project_slug} "
+                f"({who}: grant check unavailable)")
+    if level is None:
+        return (f"private rows: withheld for project {project_slug} "
+                f"({who}: no direct execute grant; no board grant at all)")
+    lvl = level if isinstance(level, str) and level else "none"
+    return (f"private rows: withheld for project {project_slug} "
+            f"({who}: no direct execute grant; "
+            f"best board grant: level={lvl}, via={via})")
+
+
 def _say_line(resp: dict, card_id, to_node: str, *, reason: Optional[str] = None) -> str:
     """The post confirmation — AND any obligation the post just DISCHARGED.
 
@@ -560,6 +660,57 @@ def _card_say_payload(from_node: str, to_node: str, kind: str, content: str,
     }
 
 
+def _run_cards_say(gw: str, token: str, self_name: str, card_id: int,
+                   content: str, kind: str, to_node: Optional[str], aj: bool, *,
+                   opt_out: bool = False, verb: str = "say") -> int:
+    """Post `content` onto a card's thread (shared by `say` + `dev-extract`).
+
+    Factored out of the `say` block without behavior change: fetch the card,
+    refuse a threadless card by name, default the recipient
+    (--to > assignee > project owner_orchestrator), POST /messages, render the
+    confirmation (including any discharged obligation, #562). `dev-extract`
+    posts through this so both verbs keep ONE recipient/redaction path.
+    """
+    st, card = _http_get_json(f"{gw}/board/cards/{card_id}", token)
+    if st != 200:
+        print(f"swarph board cards {verb}: cannot read card #{card_id}: "
+              f"{card.get('detail', card)}", file=sys.stderr)
+        return 1
+    thread_uuid = card.get("thread_uuid")
+    if not thread_uuid:
+        # Named refusal, not a silent no-op. Same reason the gateway 409s.
+        print(f"swarph board cards {verb}: card #{card_id} has no bound thread "
+              f"(it predates #181a). Run scripts/migrate_card_threads.py on "
+              f"the gateway host.", file=sys.stderr)
+        return 1
+    # #864: card GET has no owner field — only fetch projects when the
+    # cheaper defaults (explicit --to, card assignee) are absent.
+    owner = None
+    if not to_node and not card.get("assignee"):
+        owner = _project_owner_orchestrator(gw, token, card.get("project_id"))
+    try:
+        to_node, reason = _thread_recipient(
+            card, to_node, owner_orchestrator=owner,
+        )
+    except RuntimeError as exc:
+        print(f"swarph board cards {verb}: {exc}", file=sys.stderr)
+        return 1
+    st, d = _post_json(
+        f"{gw}/messages",
+        _card_say_payload(self_name, to_node, kind, content, thread_uuid,
+                          opt_out=opt_out),
+        token,
+    )
+    # A 403 here carries the gateway's explanation that attaching PUBLISHES
+    # to everyone who can read the card, now and in future, so it needs an
+    # explicit `propose` grant. `_out` passes `detail` through whole; it does
+    # not need help, and a second copy of that logic is a second thing to
+    # keep in sync.
+    return _out(
+        st, d, lambda x: _say_line(x, card_id, to_node, reason=reason), aj,
+    )
+
+
 _NO_TIMEOUT = "NO TIMEOUT — this never goes red on its own; pass --timeout-hours if it should"
 
 
@@ -1114,6 +1265,20 @@ def _build_parser() -> argparse.ArgumentParser:
                          "owner_orchestrator; refused if neither resolves)")
     _add_common(cy)
 
+    # card #1396 (#559 phase 2): the pinned dev extract. Posts through the
+    # SAME thread machinery as `say` (shared `_run_cards_say` below), so the
+    # recipient rules, redaction, and post-confirmation stay in one place.
+    from swarph_cli.commands.dev_extract import build_parser as _de_build_parser
+    _de = _de_build_parser()
+    de = cards.add_parser(
+        "dev-extract", help="build (+ post) a pinned codegraph+federation "
+        "dev extract for a card (#1396)",
+        parents=[_de], add_help=False,
+        description=_de.description)
+    de.add_argument("--to", dest="to_node", default=None,
+                    help="recipient peer (same defaulting as `say`)")
+    _add_common(de)
+
     ck = cards.add_parser(
         "ask", intermixed=True,
         help="MINT an obligation on this card: name who owes what, as a ROW")
@@ -1680,44 +1845,113 @@ def run_board(argv: list[str]) -> int:
             except ContentError as exc:
                 print(f"swarph board cards say: {exc}", file=sys.stderr)
                 return 1
-            st, card = _http_get_json(f"{gw}/board/cards/{args.id}", token)
-            if st != 200:
-                print(f"swarph board cards say: cannot read card #{args.id}: "
-                      f"{card.get('detail', card)}", file=sys.stderr)
-                return 1
-            thread_uuid = card.get("thread_uuid")
-            if not thread_uuid:
-                # Named refusal, not a silent no-op. Same reason the gateway 409s.
-                print(f"swarph board cards say: card #{args.id} has no bound thread "
-                      f"(it predates #181a). Run scripts/migrate_card_threads.py on "
-                      f"the gateway host.", file=sys.stderr)
-                return 1
-            # #864: card GET has no owner field — only fetch projects when the
-            # cheaper defaults (explicit --to, card assignee) are absent.
-            owner = None
-            if not args.to_node and not card.get("assignee"):
-                owner = _project_owner_orchestrator(gw, token, card.get("project_id"))
-            try:
-                to_node, reason = _thread_recipient(
-                    card, args.to_node, owner_orchestrator=owner,
-                )
-            except RuntimeError as exc:
-                print(f"swarph board cards say: {exc}", file=sys.stderr)
-                return 1
-            st, d = _post_json(
-                f"{gw}/messages",
-                _card_say_payload(self_name, to_node, args.kind, content, thread_uuid,
-                                  opt_out=getattr(args, "no_redact", False)),
-                token,
-            )
-            # A 403 here carries the gateway's explanation that attaching PUBLISHES
-            # to everyone who can read the card, now and in future, so it needs an
-            # explicit `propose` grant. `_out` passes `detail` through whole; it does
-            # not need help, and a second copy of that logic is a second thing to
-            # keep in sync.
-            return _out(
-                st, d, lambda x: _say_line(x, args.id, to_node, reason=reason), aj,
-            )
+            return _run_cards_say(
+                gw, token, self_name, args.id, content, args.kind,
+                args.to_node, aj, opt_out=getattr(args, "no_redact", False))
+        if args.command == "dev-extract":
+            # card #1396 (#559 phase 2). Name-token source: --symbol, else
+            # the card's own title+body; --path selects by file path.
+            # Post target: --card (via the shared `say` path) unless
+            # --print-only (print nothing-posted) or no --card (print only).
+            from swarph_cli.commands import dev_extract as _de_mod
+            card = None
+            gw_unreachable = False
+            if args.card is not None:
+                try:
+                    st, card = _http_get_json(
+                        f"{gw}/board/cards/{args.card}", token)
+                except Exception as exc:
+                    st, card = 0, {"detail": str(exc)}
+                if st == 0:
+                    gw_unreachable = True
+                if st != 200:
+                    if not args.symbol and not args.path:
+                        _why = ("gateway unreachable"
+                                if gw_unreachable else
+                                f"cannot read card #{args.card}: "
+                                f"{card.get('detail', card)}")
+                        print(f"swarph board cards dev-extract: {_why}",
+                              file=sys.stderr)
+                        return 1
+                    card = None
+            explicit = list(args.symbol or [])
+            mined = _de_mod.extract_card_tokens(card) if card else []
+            tokens = explicit + [t for t in mined if t not in explicit]
+            paths = list(args.path or [])
+            no_tokens_note = None
+            if not tokens and not paths:
+                if card is None:
+                    print("swarph board cards dev-extract: no --symbol/--path "
+                          "and no readable --card to mine tokens from",
+                          file=sys.stderr)
+                    return 2
+                # card #1410: a READABLE card with no minable tokens is a
+                # normal (empty) extract, not an error — exit 0 with its own
+                # plain line. A truly UNREADABLE card keeps the error path
+                # above (exit 1, cannot read card).
+                no_tokens_note = f"card #{args.card}: no symbols to look up"
+            # card #1410: the card's board project slug resolves the same
+            # way as every other card-artifact project read (card row
+            # carries project_id; the slug lives on GET /board/projects,
+            # matched by id). Unresolvable -> None -> public only.
+            proj_slug = None
+            if card:
+                try:
+                    _pst, _pdata = _http_get_json(
+                        f"{gw.rstrip('/')}/board/projects", token)
+                    _rows = (_pdata if isinstance(_pdata, list)
+                             else (_pdata or {}).get("projects", []))
+                    if _pst and 200 <= _pst < 300:
+                        proj_slug = _de_mod.card_project_slug(card, _rows)
+                except Exception:
+                    proj_slug = None
+            # card #1410 rework: entitlement resolves ONCE per run — the
+            # runner's OWN direct execute grant on the card's project
+            # (GET /peers/{peer}/grants, direct row only), or public only.
+            # Anything POSTED carries public rows only, whoever runs it.
+            runner_name, runner_source = _resolve_self_with_source(
+                args.self_name)
+            entitled, _lvl, _via, _state = (False, None, None, "unavailable")
+            if card is not None and proj_slug:
+                entitled, _lvl, _via, _state = _dev_extract_entitlement(
+                    gw, token, runner_name, proj_slug)
+            privacy_line = _dev_extract_privacy_line(
+                card, proj_slug, entitled, _lvl, _via, _state,
+                runner=runner_name, source=runner_source,
+                gw_unreachable=gw_unreachable)
+            posting = args.card is not None and not args.print_only
+            post_safe = posting
+            ex = _de_mod.build_extract(
+                tokens=tokens, index_path=args.index,
+                fed_report=args.fed_report, structurizr_ws=args.structurizr_ws,
+                card=card, paths=paths, project_slug=proj_slug,
+                entitled=(entitled and not post_safe))
+            if getattr(args, "json", False):
+                # card #1396: redact WITHHELD registry entries (no private
+                # paths/index times in machine-readable output). The
+                # no-tokens notice goes to stderr so stdout stays parseable —
+                # and so does the privacy line. A posting-shaped run
+                # (--card without --print-only) builds post-safe: the
+                # withheld set is count-only even in --json.
+                if no_tokens_note:
+                    print(no_tokens_note, file=sys.stderr)
+                print(privacy_line, file=sys.stderr)
+                print(json.dumps(_de_mod.redact_for_json(ex, post_safe=post_safe),
+                                 indent=2, default=str))
+                return 0
+            body = _de_mod.render(ex, max_lines=args.max_lines,
+                                  post_safe=post_safe)
+            if args.print_only or args.card is None:
+                if no_tokens_note:
+                    print(no_tokens_note)
+                print(privacy_line)
+                print(body, end="")
+                return 0
+            print(privacy_line)
+            return _run_cards_say(
+                gw, token, self_name, args.card, body, "fyi",
+                args.to_node, aj, opt_out=getattr(args, "no_redact", False),
+                verb="dev-extract")
         if args.command == "ready":
             st, d = _patch_json(f"{gw}/board/cards/{args.id}", {"actor": self_name, "move_ready": not args.clear}, token)
             return _out(st, d, lambda x: f"card #{x.get('id')} move_ready -> {x.get('move_ready')}", aj)