swarph-cli 0.72.44__tar.gz → 0.72.45__tar.gz

{swarph_cli-0.72.44/src/swarph_cli.egg-info → swarph_cli-0.72.45}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: swarph-cli
-Version: 0.72.44
+Version: 0.72.45
 Summary: The `swarph` binary — a multi-LLM CLI and mesh-gateway client + bundled server (`swarph gateway`): one-shot prompts across providers, interactive `chat`, multi-provider `spawn` (claude/codex/antigravity via a ProviderMembrane with subprocess billing-scrub), `mesh` send/inbox/register, `brain-ask` over the swarph-brain (gbrain) semantic memory, git-backed `assisted_memory`, per-invocation `gh` identity routing, a silent DM-wake hook, session `import`, and a stranded-session `watchdog`.
 Author: Pierre Samson, Claude Opus
 License: MIT

{swarph_cli-0.72.44 → swarph_cli-0.72.45}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "swarph-cli"
-version = "0.72.44"
+version = "0.72.45"
 description = "The `swarph` binary — a multi-LLM CLI and mesh-gateway client + bundled server (`swarph gateway`): one-shot prompts across providers, interactive `chat`, multi-provider `spawn` (claude/codex/antigravity via a ProviderMembrane with subprocess billing-scrub), `mesh` send/inbox/register, `brain-ask` over the swarph-brain (gbrain) semantic memory, git-backed `assisted_memory`, per-invocation `gh` identity routing, a silent DM-wake hook, session `import`, and a stranded-session `watchdog`."
 readme = "README.md"
 license = { text = "MIT" }

{swarph_cli-0.72.44 → swarph_cli-0.72.45}/src/swarph_cli/__init__.py

@@ -16,6 +16,6 @@ The architecture splits CLI from substrate so:
 
 from __future__ import annotations
 
-__version__ = "0.72.44"
+__version__ = "0.72.45"
 
 __all__ = ["__version__"]

{swarph_cli-0.72.44 → swarph_cli-0.72.45}/src/swarph_cli/commands/event.py

@@ -20,7 +20,7 @@ from ._gateway_client import (
     resolve_self_name,
     resolve_token,
 )
-from swarph_cli.redact import redact_text
+from swarph_cli.redact import encode_outbound_json, redact_text
 
 
 def _build_parser() -> argparse.ArgumentParser:
@@ -47,6 +47,34 @@ def _build_parser() -> argparse.ArgumentParser:
     return p
 
 
+class ChainTokenAttachError(RuntimeError):
+    """The redacted event bytes are not JSON, so the chain token is not sent."""
+
+
+def _attach_chain_token(data: bytes, chain_token: str) -> bytes:
+    """Add the CLI chain token onto an already-redacted event body.
+
+    Same shape as ``mcp_server._search``: redact first, then set the one
+    field that must reach the wire. A pasted chain_token line in the payload
+    was already scrubbed and is not this value.
+
+    Redaction can rewrite a quote inside the content string and leave bytes
+    that are not JSON. That refusal is by name (``JSONDecodeError`` or
+    ``UnicodeDecodeError``). The token is not copied into the error, and the
+    caller sends nothing.
+    """
+    try:
+        body_obj = json.loads(data.decode("utf-8"))
+        inner = json.loads(body_obj["content"])
+    except (UnicodeDecodeError, json.JSONDecodeError) as exc:
+        raise ChainTokenAttachError(
+            f"_attach_chain_token refused: {type(exc).__name__}"
+        ) from None
+    inner["swarph_event"]["chain_token"] = chain_token
+    body_obj["content"] = json.dumps(inner, separators=(",", ":"), sort_keys=True)
+    return json.dumps(body_obj).encode("utf-8")
+
+
 def _post_channel(
     *,
     channel: str,
@@ -76,8 +104,6 @@ def _post_channel(
     base = (gateway or env_gateway()).rstrip("/")
     payload = redact_text(payload, caller="event.emit") or ""
     ev: dict = {"event": event, "payload": payload}
-    if chain_token is not None:  # carry an explicit "" through; only omit when unset
-        ev["chain_token"] = chain_token
     # Sentinel-wrapped so P1's guard can UNAMBIGUOUSLY identify an event post: a
     # normal channel message won't carry the top-level `swarph_event` key, so the
     # guard keys off `content.swarph_event` — never a false-positive on a plain
@@ -91,7 +117,28 @@ def _post_channel(
         "kind": "fyi",
         "content": json.dumps(content, separators=(",", ":"), sort_keys=True),
     }
-    status, resp = post_json(f"{base}/messages", body, token)
+    # Redact with no chain token in the body. Attach the CLI value after, so
+    # only that value skips redaction. An explicit "" is carried; omit only
+    # when the flag was unset. Card #1472.
+    if chain_token is None:
+        status, resp = post_json(f"{base}/messages", body, token)
+    else:
+        # Attach after redaction. If those bytes are not JSON, name the
+        # refusal and return before post_json: nothing is sent, no traceback.
+        try:
+            encoded = _attach_chain_token(
+                encode_outbound_json(body, caller="event.emit"),
+                chain_token,
+            )
+        except ChainTokenAttachError as exc:
+            print(f"swarph event: {exc}", file=sys.stderr)
+            return 2
+        status, resp = post_json(
+            f"{base}/messages",
+            body,
+            token,
+            encoded=encoded,
+        )
     if 200 <= status < 300:
         print(f"emitted event={event} channel={channel} id={resp.get('id')}")
         return 0

{swarph_cli-0.72.44 → swarph_cli-0.72.45}/src/swarph_cli/commands/mcp_server.py

@@ -89,10 +89,16 @@ def _search(query: str, *, url: str, token: str | None = None) -> list[dict]:
     transport exception.
     """
     endpoint = url.rstrip("/") + "/api/ask"
-    payload: dict = {"message": query}
+    # Redact the query only. The auth token is the credential this call
+    # presents to the search face. Putting it in the dict that
+    # encode_outbound_json walks replaces a credential-shaped value
+    # (secrets.token_urlsafe(32), the gateway mint) with
+    # [REDACTED:HIGH_ENTROPY] before the request is sent. Card #1472.
+    data = encode_outbound_json({"message": query}, caller="mcp_server._search")
     if token:
-        payload["token"] = token
-    data = encode_outbound_json(payload, caller="mcp_server._search")
+        body_obj = json.loads(data.decode("utf-8"))
+        body_obj["token"] = token
+        data = json.dumps(body_obj).encode("utf-8")
     req = urllib.request.Request(
         endpoint,
         data=data,

{swarph_cli-0.72.44 → swarph_cli-0.72.45}/src/swarph_cli/commands/mesh.py

@@ -444,9 +444,16 @@ def _post_json(
     token: str,
     *,
     timeout: float = 10.0,
+    encoded: bytes | None = None,
 ) -> tuple[int, dict]:
     _require_absolute_gateway_url(url)
-    data = encode_outbound_json(body, caller="mesh._post_json")
+    # event.emit redacts with no chain token, then passes the bytes with the
+    # CLI --chain-token already attached. Encoding those bytes again would
+    # strip that one value. Every other caller leaves encoded unset.
+    if encoded is None:
+        data = encode_outbound_json(body, caller="mesh._post_json")
+    else:
+        data = encoded
     req = urllib.request.Request(
         url,
         data=data,

{swarph_cli-0.72.44 → swarph_cli-0.72.45}/src/swarph_cli/redact.py

@@ -132,6 +132,11 @@ _ANTHROPIC_RE = re.compile(r"\bsk-ant-[A-Za-z0-9\-_]{8,}\b")
 _OPENAI_RE = re.compile(r"\bsk-(?!ant-)(?:proj-|svcacct-)?[A-Za-z0-9\-_]{16,}\b")
 _XAI_RE = re.compile(r"\bxai-[A-Za-z0-9\-_]{16,}\b")
 _GCP_RE = re.compile(r"\bAIza[0-9A-Za-z\-_]{35}\b")
+_GCP_FINAL_RE = re.compile(
+    r"(?:\bAIza[0-9A-Za-z\-_]{34}(?:-|[0-9A-Za-z_](?![0-9A-Za-z_]))"
+    r"|(?<=[0-9A-Za-z_])AIza[0-9A-Za-z\-_]{34}[0-9A-Za-z_](?![0-9A-Za-z_])"
+    r"|(?<=\w)AIza[0-9A-Za-z\-_]{34}-)"
+)
 _SLACK_RE = re.compile(r"\bxox[baprs]-[A-Za-z0-9\-]{8,}\b")
 _AWS_KEY_RE = re.compile(r"\b(?:AKIA|ASIA)[0-9A-Z]{16}\b")
 _AWS_SECRET_RE = re.compile(
@@ -332,6 +337,7 @@ def redact_text(
     # Layer 6: Shannon Entropy Scoring
     out = _SECRET_ASSIGN_RE.sub(_replace_secret_assignment, out)
     out = _replace_standalone_tokens(out)
+    out = _GCP_FINAL_RE.sub("[REDACTED:GCP_API_KEY]", out)
 
     return out
 

{swarph_cli-0.72.44 → swarph_cli-0.72.45}/src/swarph_cli/scrub.py

@@ -39,6 +39,13 @@ _SECRET_PATTERNS = [
     # password/token/secret assignments.
     (re.compile(r"(?i)\b(password|passwd|pwd|api[_-]?key|auth[_-]?token|secret)\b\s*[:=]\s*\S+"),
      r"\1=[REDACTED]"),
+    (re.compile(r"\bsk-(?!ant-)(?:proj-|svcacct-)?[A-Za-z0-9\-_]{16,}\b"),
+     "[REDACTED-API-KEY]"),
+    (re.compile(
+        r"(?:\bAIza[0-9A-Za-z\-_]{34}(?:-|[0-9A-Za-z_](?![0-9A-Za-z_]))"
+        r"|(?<=[0-9A-Za-z_])AIza[0-9A-Za-z\-_]{34}[0-9A-Za-z_](?![0-9A-Za-z_])"
+        r"|(?<=\w)AIza[0-9A-Za-z\-_]{34}-)"),
+     "[REDACTED-API-KEY]"),
 ]
 
 

{swarph_cli-0.72.44 → swarph_cli-0.72.45/src/swarph_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: swarph-cli
-Version: 0.72.44
+Version: 0.72.45
 Summary: The `swarph` binary — a multi-LLM CLI and mesh-gateway client + bundled server (`swarph gateway`): one-shot prompts across providers, interactive `chat`, multi-provider `spawn` (claude/codex/antigravity via a ProviderMembrane with subprocess billing-scrub), `mesh` send/inbox/register, `brain-ask` over the swarph-brain (gbrain) semantic memory, git-backed `assisted_memory`, per-invocation `gh` identity routing, a silent DM-wake hook, session `import`, and a stranded-session `watchdog`.
 Author: Pierre Samson, Claude Opus
 License: MIT

{swarph_cli-0.72.44 → swarph_cli-0.72.45}/src/swarph_cli.egg-info/SOURCES.txt

@@ -285,6 +285,7 @@ tests/test_1452_rework2_engine.py
 tests/test_1452_rework3_engine.py
 tests/test_1452_standing_wake_expiry.py
 tests/test_1470_gh_router_fail_closed.py
+tests/test_1472_redact_boundaries.py
 tests/test_1478_triage_dm.py
 tests/test_183_card_anchor.py
 tests/test_184_notify_honesty.py

swarph_cli-0.72.45/tests/test_1472_redact_boundaries.py

@@ -0,0 +1,218 @@
+"""Card #1472: pasted chain_token text stays scrubbed, and a trailing-dash
+AIza key is scrubbed too.
+
+Every secret is built at runtime. No realistic key literal.
+"""
+from __future__ import annotations
+
+import json
+
+from swarph_cli.redact import encode_outbound_json, redact_text
+from swarph_cli.scrub import scrub_text
+
+
+def _sk_proj() -> str:
+    return "sk-proj-" + ("n7" * 12)
+
+
+def _ghp() -> str:
+    return "ghp_" + ("Ab" * 16)
+
+
+def _aiza_trailing_dash() -> str:
+    # AIza + 35 chars, last character '-'. No digits, so the entropy
+    # layer does not also eat it: only the AIza rule can.
+    secret = "AI" + "za" + ("m" * 34) + "-"
+    assert len(secret) == 39
+    assert secret.endswith("-")
+    return secret
+
+
+def test_dm_body_pasted_chain_token_line_is_fully_redacted():
+    """Drop's measured leak: keys sit inside a pasted "chain_token": "..." value.
+
+    encode_outbound_json is what mesh._post_json sends. Both keys must be
+    gone from those bytes. A shield that puts the quoted span back fails this.
+    """
+    sk = _sk_proj()
+    ghp = _ghp()
+    content = (
+        'pasted log "chain_token": "\n'
+        f"export OPENAI_API_KEY={sk}\n"
+        f"GITHUB={ghp}\n"
+        '" end'
+    )
+    followed = f"chain_token: note\n{sk}\n{ghp}"
+    for text in (content, followed):
+        body = {
+            "from_node": "friendly-coder",
+            "to_node": "lab-ovh",
+            "kind": "answer",
+            "content": text,
+        }
+        raw = encode_outbound_json(body, caller="t").decode("utf-8")
+        assert sk not in raw
+        assert ghp not in raw
+        assert "REDACTED" in raw
+
+
+def test_redact_text_redacts_chain_token_json_holding_an_sk_proj_key():
+    sk = _sk_proj()
+    blob = '{"chain_token": "' + sk + '"}'
+    out = redact_text(blob, caller="t")
+    assert sk not in out
+    assert "REDACTED" in out
+
+
+def test_chain_placeholder_literal_is_left_alone():
+    literal = "SWARPH.CHAIN.0.END"
+    assert redact_text(f"see {literal} here", caller="t") == f"see {literal} here"
+    sk = _sk_proj()
+    text = literal + '\n{"chain_token": "' + sk + '"}'
+    out = redact_text(text, caller="t")
+    assert out.startswith(literal)
+    assert sk not in out
+    assert json.loads(out.split("\n", 1)[1])["chain_token"] != sk
+
+
+def test_aiza_key_then_hyphen_suffix_is_redacted():
+    """A '-' after the 35-character body is a boundary, not a longer tail.
+
+    key-x and key-- must be scrubbed. Putting '-' back into the lookahead
+    (?![0-9A-Za-z\\-_]) hides both, because the next character is '-'.
+    """
+    secret = "AI" + "za" + ("m" * 35)
+    assert len(secret) == 39
+    assert not secret.endswith("-")
+    for suffix in ("-x", "--"):
+        text = secret + suffix
+        scrubbed = scrub_text(text)
+        assert scrubbed is not None
+        assert secret not in scrubbed
+        assert "REDACTED" in scrubbed
+        redacted = redact_text(text, caller="t")
+        assert secret not in redacted
+        assert "REDACTED" in redacted
+
+
+def _assert_scrub_and_redact(text: str, *secrets: str) -> None:
+    scrubbed = scrub_text(text)
+    assert scrubbed is not None
+    redacted = redact_text(text, caller="t")
+    for secret in secrets:
+        assert secret not in scrubbed
+        assert secret not in redacted
+    assert "REDACTED" in scrubbed
+    assert "REDACTED" in redacted
+
+
+def test_aiza_dash_key_followed_by_word_char_is_redacted():
+    """A 35th character of '-' then x, _, or 'abc def' (drop #4429).
+
+    {35}(?![0-9A-Za-z_]) refuses that follower, so the key stays visible.
+    Both scrub_text and redact_text have to take the dash.
+    """
+    secret = _aiza_trailing_dash()
+    for suffix in ("x", "_", "abc def"):
+        _assert_scrub_and_redact(secret + suffix, secret)
+
+
+def test_dash_ending_aiza_then_api_key_hides_key_and_secret():
+    """:<dash-ending key>api_key=<secret> leaves neither (drop #4437).
+
+    The match stops on the key. A greedy tail would swallow api_key, and
+    the secret would stay where the keyword-value rule should have put
+    [REDACTED:DSN_CREDENTIAL].
+    """
+    key = _aiza_trailing_dash()
+    secret = "plain-" + "secret-value"
+    text = f":{key}api_key={secret}"
+    scrubbed = scrub_text(text)
+    assert scrubbed is not None
+    assert key not in scrubbed
+    assert secret not in scrubbed
+    assert "api_key=[REDACTED]" in scrubbed
+    redacted = redact_text(text, caller="t")
+    assert key not in redacted
+    assert secret not in redacted
+    assert "api_key=[REDACTED:DSN_CREDENTIAL]" in redacted
+
+
+def test_dash_ending_aiza_glued_through_chain_token_redacts_both_keys():
+    """token=<dash-ending key>--chain_token<full key> leaves neither key.
+
+    A match that stops on the first key leaves the second glued to the
+    word character at the end of chain_token. Values are built here, with
+    no digits, so the entropy layer cannot hide a miss.
+    """
+    dash_key = _aiza_trailing_dash()
+    full_key = "AI" + "za" + ("n" * 35)
+    assert len(full_key) == 39
+    assert "-" not in full_key
+    text = f"token={dash_key}--chain_token{full_key}"
+    _assert_scrub_and_redact(text, dash_key, full_key)
+
+
+def test_drop_4452_chain_and_proj_shapes_leave_no_key():
+    """Drop #4452's two shapes, on scrub_text and redact_text.
+
+    chain_token<dash key>x<full key>{ leaves neither key. A proj key glued
+    to a dash-ending key and then api_key=<another dash key> leaves none of
+    the three. The keyword value below is a low-entropy secret: scrub_text
+    must hide it. redact_text's OpenAI rule is main's, and it still runs
+    before the keyword rule, so that low-entropy value can remain there.
+    """
+    dash = _aiza_trailing_dash()
+    full = "AI" + "za" + ("n" * 35)
+    _assert_scrub_and_redact(f"chain_token{dash}x{full}{{", dash, full)
+
+    proj = "sk-proj-" + ("n7" * 12)
+    trail = "AI" + "za" + ("p" * 34) + "-"
+    assert len(trail) == 39 and trail.endswith("-")
+    _assert_scrub_and_redact(f"{proj}{dash}api_key={trail}", proj, dash, trail)
+
+    secret = "plain-" + "secret-value"
+    text = f"{proj}{dash}api_key={secret}"
+    scrubbed = scrub_text(text)
+    assert scrubbed is not None
+    assert proj not in scrubbed
+    assert dash not in scrubbed
+    assert secret not in scrubbed
+    redacted = redact_text(text, caller="t")
+    assert proj not in redacted
+    assert dash not in redacted
+
+
+def test_dash_ending_key_glued_after_word_char_is_redacted():
+    """A dash-ending key glued after x, _, another key, or é is redacted.
+
+    No digits, so the entropy layer cannot hide a miss. Both scrub_text
+    and redact_text have to take the key.
+    """
+    dash = _aiza_trailing_dash()
+    other = "AI" + "za" + ("q" * 35)
+    assert len(other) == 39
+    for prefix in ("x", "_", other, "é"):
+        _assert_scrub_and_redact(prefix + dash, dash)
+
+
+def test_aiza_key_ending_in_dash_is_redacted_before_space_quote_or_punctuation():
+    secret = _aiza_trailing_dash()
+    samples = [
+        f"prefix {secret} suffix",
+        f'"{secret}"',
+        f"'{secret}'",
+        secret,
+        f"{secret}.",
+        f"{secret},",
+        f"({secret})",
+        f"{secret}\nnext",
+    ]
+    for text in samples:
+        scrubbed = scrub_text(text)
+        assert scrubbed is not None
+        assert secret not in scrubbed
+        assert "REDACTED" in scrubbed
+        redacted = redact_text(text, caller="t")
+        assert secret not in redacted
+        assert "REDACTED" in redacted

swarph_cli-0.72.45/tests/test_event_emit.py

@@ -0,0 +1,166 @@
+def test_event_emit_posts_with_tag_and_token(monkeypatch):
+    from swarph_cli.commands import event as evmod
+    captured = {}
+    monkeypatch.setattr(evmod, "_post_channel", lambda **kw: captured.update(kw) or 0)
+    rc = evmod.run_event(["emit", "stage-done", "the output", "--chain-token", "TOK", "--channel", "events"])
+    assert rc == 0
+    assert captured["channel"] == "events"
+    assert captured["event"] == "stage-done"
+    assert captured["payload"] == "the output"
+    assert captured["chain_token"] == "TOK"
+
+def test_event_emit_no_token(monkeypatch):
+    from swarph_cli.commands import event as evmod
+    captured = {}
+    monkeypatch.setattr(evmod, "_post_channel", lambda **kw: captured.update(kw) or 0)
+    evmod.run_event(["emit", "e", "p"])
+    assert captured.get("chain_token") is None  # argparse default=None, not ""
+
+
+def test_event_emit_real_envelope_is_sentinel_wrapped(monkeypatch):
+    # exercise the REAL _post_channel (not the seam) to prove the content envelope is
+    # sentinel-wrapped so P1's guard identifies events unambiguously (a plain channel
+    # message won't carry the top-level `swarph_event` key). The CLI chain token is
+    # attached on the bytes after redaction, not inside the pre-redact body.
+    import json
+    from swarph_cli.commands import event as evmod
+    monkeypatch.setattr(evmod, "resolve_self_name", lambda *a, **k: "lab-ovh")
+    monkeypatch.setattr(evmod, "resolve_token", lambda *a, **k: "tok")
+    captured = {}
+
+    def _capture(url, body, token, encoded=None, timeout=10.0):
+        captured.update(body=body, encoded=encoded)
+        return 200, {"id": 1}
+
+    monkeypatch.setattr(evmod, "post_json", _capture)
+    rc = evmod.run_event(["emit", "stage-done", "out", "--chain-token", "TOK"])
+    assert rc == 0
+    content = json.loads(captured["body"]["content"])
+    assert "swarph_event" in content
+    assert content["swarph_event"] == {"event": "stage-done", "payload": "out"}
+    assert captured["body"]["kind"] == "fyi"  # VALID_KINDS-safe; P1 promotes to first-class
+    wire = json.loads(json.loads(captured["encoded"])["content"])
+    assert wire["swarph_event"] == {"event": "stage-done", "payload": "out", "chain_token": "TOK"}
+
+
+def test_chain_token_reaches_the_wire_and_the_payload_is_still_scrubbed(monkeypatch):
+    """The CLI --chain-token is attached after redaction, like _search.
+
+    A producer-signed token and a dotless credential-shaped token both reach
+    the wire. A classic key in the payload does not. A pasted chain_token
+    field is not this bypass.
+    """
+    import json
+    import secrets
+
+    from swarph_cli.chain_token import sign_chain_token
+    from swarph_cli.commands import event as evmod
+    from swarph_cli.redact import redact_text
+
+    signed = sign_chain_token("producer-secret-xyz", "chain-1", 1, "jti-abc")
+    opaque = None
+    for _ in range(40):
+        candidate = secrets.token_urlsafe(32)
+        if redact_text(candidate, caller="t") != candidate:
+            opaque = candidate
+            break
+    assert opaque is not None
+    classic = "sk-" + ("cd" * 12)
+
+    class _Resp:
+        status = 200
+
+        def __enter__(self):
+            return self
+
+        def __exit__(self, *args):
+            return False
+
+        def read(self):
+            return b'{"id": 7}'
+
+    def emit(chain):
+        captured = {}
+
+        def fake_urlopen(req, timeout=None):
+            captured["raw"] = req.data
+            return _Resp()
+
+        monkeypatch.setattr(
+            "swarph_cli.commands.mesh.urllib.request.urlopen", fake_urlopen
+        )
+        monkeypatch.setattr(evmod, "resolve_self_name", lambda *a, **k: "friendly-coder")
+        monkeypatch.setattr(evmod, "resolve_token", lambda *a, **k: "tok")
+        rc = evmod.run_event([
+            "emit", "stage-done", "note " + classic,
+            "--chain-token", chain,
+            "--gateway", "http://127.0.0.1:9",
+        ])
+        assert rc == 0, rc
+        body = json.loads(captured["raw"].decode("utf-8"))
+        return json.loads(body["content"])["swarph_event"]
+
+    for chain in (signed, opaque):
+        ev = emit(chain)
+        assert ev["chain_token"] == chain
+        assert classic not in ev["payload"]
+        assert "REDACTED" in ev["payload"]
+
+
+def test_chain_token_on_unparseable_body_refuses_and_sends_nothing(monkeypatch, capsys):
+    """Redaction can break the content JSON (password="}, PASSWORD=", api_key=").
+
+    --chain-token must refuse by name, send nothing, and exit nonzero.
+    No traceback, and neither the payload nor the token reaches the stubbed wire.
+    """
+    from swarph_cli.commands import event as evmod
+
+    token = "chain-token-must-not-leak"
+    payloads = (
+        'password="}',
+        'export PASSWORD=" x',
+        'api_key="',
+    )
+    calls = []
+
+    class _Resp:
+        status = 200
+
+        def __enter__(self):
+            return self
+
+        def __exit__(self, *args):
+            return False
+
+        def read(self):
+            return b'{"id": 1}'
+
+    def fake_urlopen(req, timeout=None):
+        calls.append(req.data or b"")
+        return _Resp()
+
+    monkeypatch.setattr(
+        "swarph_cli.commands.mesh.urllib.request.urlopen", fake_urlopen
+    )
+    monkeypatch.setattr(evmod, "resolve_self_name", lambda *a, **k: "friendly-coder")
+    monkeypatch.setattr(evmod, "resolve_token", lambda *a, **k: "tok")
+
+    for payload in payloads:
+        before = len(calls)
+        rc = evmod.run_event([
+            "emit", "stage-done", payload,
+            "--chain-token", token,
+            "--gateway", "http://127.0.0.1:9",
+        ])
+        captured = capsys.readouterr()
+        assert rc != 0
+        assert "Traceback" not in captured.err
+        assert "Traceback" not in captured.out
+        assert "_attach_chain_token refused: JSONDecodeError" in captured.err
+        assert token not in captured.err
+        assert token not in captured.out
+        assert payload not in captured.err
+        assert payload not in captured.out
+        assert calls[before:] == []
+
+    assert calls == []

{swarph_cli-0.72.44 → swarph_cli-0.72.45}/tests/test_mcp_server.py

@@ -94,6 +94,45 @@ def test_search_passes_token_when_given():
     assert captured["data"]["token"] == "secret"
 
 
+def test_search_keeps_a_credential_shaped_token_and_scrubs_the_message():
+    """PR 648: the auth token used to ride inside the redacted body.
+
+    A gateway-mint shape (token_urlsafe(32)) is often replaced with
+    [REDACTED:HIGH_ENTROPY]. The message is still scrubbed.
+    """
+    import secrets
+
+    from swarph_cli.redact import redact_text
+
+    tok = None
+    for _ in range(40):
+        candidate = secrets.token_urlsafe(32)
+        if redact_text(candidate, caller="t") != candidate:
+            tok = candidate
+            break
+    assert tok is not None, "need one credential-shaped token the redactor would eat"
+    classic = "sk-" + ("ab" * 12)
+    captured = {}
+
+    def _fake(req, timeout=None):  # noqa: ANN001 - test double
+        captured["data"] = json.loads(req.data.decode("utf-8"))
+        resp = mock.MagicMock()
+        resp.read.return_value = json.dumps({"results": []}).encode("utf-8")
+        resp.__enter__ = lambda s: s
+        resp.__exit__ = lambda s, *a: False
+        return resp
+
+    with mock.patch(
+        "swarph_cli.commands.mcp_server.urllib.request.urlopen", _fake
+    ):
+        mcp_server._search(
+            "look " + classic, url="https://metaedge.surf/", token=tok
+        )
+    assert captured["data"]["token"] == tok
+    assert classic not in captured["data"]["message"]
+    assert "REDACTED" in captured["data"]["message"]
+
+
 # --------------------------------------------------------------------------- #
 # _add — parse_uri gate + add.run_add dispatch
 # --------------------------------------------------------------------------- #

{swarph_cli-0.72.44 → swarph_cli-0.72.45}/tests/test_scrub.py

@@ -14,9 +14,15 @@ from swarph_cli.scrub import scrub_text
 @pytest.mark.parametrize("secret", [
     "sk-ant-aaaa-bbbb-cccc-dddd",
     "sk-abcdefghijklmnop123456",
+    # Hyphenated OpenAI shapes, built here so the source has no key literal.
+    # The old [A-Za-z0-9] class stopped at the hyphen (card #1472).
+    "sk-proj-" + ("n7" * 12),
+    "sk-svcacct-" + ("m8" * 12),
     "xai-abcdefghijklmnop123456",
     # Built at runtime: the literal full shape trips gitleaks gcp-api-key.
     "AIza" + "SyDdI0T9mbB4y7KzQ3wX2vU5tS8rR1pP6oO",
+    # 35th character is '-'. A closing \b does not match before the space.
+    "AI" + "za" + ("m" * 34) + "-",
     "ghp_abcdefghijklmnopqrstuvwx1234567890",
     # Built at runtime: the literal full shape trips push protection.
     "xoxb-" + "123456789012-abcdefghijklmnop",