swarph-cli 0.72.7__tar.gz → 0.72.8__tar.gz

{swarph_cli-0.72.7/src/swarph_cli.egg-info → swarph_cli-0.72.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: swarph-cli
-Version: 0.72.7
+Version: 0.72.8
 Summary: The `swarph` binary — a multi-LLM CLI and mesh-gateway client + bundled server (`swarph gateway`): one-shot prompts across providers, interactive `chat`, multi-provider `spawn` (claude/codex/antigravity via a ProviderMembrane with subprocess billing-scrub), `mesh` send/inbox/register, `brain-ask` over the swarph-brain (gbrain) semantic memory, git-backed `assisted_memory`, per-invocation `gh` identity routing, a silent DM-wake hook, session `import`, and a stranded-session `watchdog`.
 Author: Pierre Samson, Claude Opus
 License: MIT

{swarph_cli-0.72.7 → swarph_cli-0.72.8}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "swarph-cli"
-version = "0.72.7"
+version = "0.72.8"
 description = "The `swarph` binary — a multi-LLM CLI and mesh-gateway client + bundled server (`swarph gateway`): one-shot prompts across providers, interactive `chat`, multi-provider `spawn` (claude/codex/antigravity via a ProviderMembrane with subprocess billing-scrub), `mesh` send/inbox/register, `brain-ask` over the swarph-brain (gbrain) semantic memory, git-backed `assisted_memory`, per-invocation `gh` identity routing, a silent DM-wake hook, session `import`, and a stranded-session `watchdog`."
 readme = "README.md"
 license = { text = "MIT" }

{swarph_cli-0.72.7 → swarph_cli-0.72.8}/src/swarph_cli/__init__.py

@@ -16,6 +16,6 @@ The architecture splits CLI from substrate so:
 
 from __future__ import annotations
 
-__version__ = "0.72.7"
+__version__ = "0.72.8"
 
 __all__ = ["__version__"]

{swarph_cli-0.72.7 → swarph_cli-0.72.8}/src/swarph_cli/commands/watchdog.py

@@ -468,6 +468,14 @@ def _gateway_configured(gateway: str) -> bool:
     """
     return bool((gateway or "").strip())
 
+def _resolve_unread_token(token: Optional[str]) -> Optional[str]:
+    """Token precedence for the unread check: explicit arg (cron setups
+    pass env straight through), else the watchdog identity's token file
+    (card #1059 — template units have no env). The VALUE is never logged.
+    """
+    return token or _read_service_token()
+
+
 def _gateway_unread_count(gateway: str, peer: str, token: Optional[str]) -> Optional[int]:
     """Query gateway for unread DM count addressed to peer.
 
@@ -483,15 +491,15 @@ def _gateway_unread_count(gateway: str, peer: str, token: Optional[str]) -> Opti
     the code it was documenting — found 2026-08-12 when the contradiction
     caused a real reader to conclude a gateway/token outage makes A1 MORE
     eager, when it makes A1 permanently inert for that cell instead.
+
+    Prefers the count-only endpoint (card #1059: no bodies cross the wire);
+    a 404 (gateway predates the endpoint) falls back to the list query so a
+    mixed fleet never goes blind from the client side alone.
     """
     if not _gateway_configured(gateway):
         return None
-    query = urllib.parse.urlencode({"to_node": peer, "unread_only": "true", "limit": 1})
-    url = f"{gateway.rstrip('/')}/messages?{query}"
-    req = urllib.request.Request(url)
-    if token:
-        req.add_header("Authorization", f"Bearer {token}")
-    else:
+    token = _resolve_unread_token(token)
+    if not token:
         # A missing token and a network outage both surface as None to the
         # caller (correctly — the decision matrix treats them the same way),
         # but they are different FACTS an operator would want to know apart.
@@ -503,10 +511,50 @@ def _gateway_unread_count(gateway: str, peer: str, token: Optional[str]) -> Opti
               f"unread-count check may 401 if the gateway requires auth; "
               f"A1 stays inert until one is set",
               file=sys.stderr)
+    count = _gateway_unread_via_count(gateway, peer, token)
+    if count is not None:
+        return count
+    return _gateway_unread_via_list(gateway, peer, token)
+
+
+def _gateway_request(gateway: str, path: str, query: dict,
+                     token: Optional[str]):
+    """GET path+query with an optional Bearer token. Returns the decoded
+    JSON body, or (None, status) on transport failure — the status lets
+    callers tell a missing route (404: fall back) from a dead end."""
+    url = f"{gateway.rstrip('/')}{path}?{urllib.parse.urlencode(query)}"
+    req = urllib.request.Request(url)
+    if token:
+        req.add_header("Authorization", f"Bearer {token}")
     try:
         with urllib.request.urlopen(req, timeout=5) as resp:
-            data = json.loads(resp.read().decode("utf-8"))
-    except (urllib.error.URLError, urllib.error.HTTPError, OSError, json.JSONDecodeError):
+            return json.loads(resp.read().decode("utf-8")), resp.status
+    except urllib.error.HTTPError as exc:
+        return None, exc.code
+    except (urllib.error.URLError, OSError, json.JSONDecodeError):
+        return None, None
+
+
+def _gateway_unread_via_count(gateway: str, peer: str,
+                             token: Optional[str]) -> Optional[int]:
+    """Count-only read: {"to_node", "n"}. No bodies cross the wire, so a
+    least-privilege watchdog identity suffices (card #1059)."""
+    data, _status = _gateway_request(
+        gateway, "/messages/unread-count", {"to_node": peer}, token)
+    if isinstance(data, dict) and isinstance(data.get("n"), int):
+        return data["n"]
+    return None
+
+
+def _gateway_unread_via_list(gateway: str, peer: str,
+                            token: Optional[str]) -> Optional[int]:
+    """Pre-count-endpoint fallback: parse the list query. Kept so a mixed
+    fleet (new client, old gateway) degrades to body reads, never to
+    blindness — the 404 is the only trigger, never a 403/401."""
+    data, status = _gateway_request(
+        gateway, "/messages",
+        {"to_node": peer, "unread_only": "true", "limit": 1}, token)
+    if status == 404:
         return None
     # Gateway shape varies — handle both list and {"messages": [...]} forms
     if isinstance(data, list):
@@ -1874,6 +1922,37 @@ def _execstart_flags(args: argparse.Namespace) -> str:
     return (" " + " ".join(parts)) if parts else ""
 
 
+def _watchdog_service_token_path() -> Path:
+    """Where the watchdog identity's token lives. Overridable for tests
+    and unusual homes; never a unit file, never argv (card #1059)."""
+    return Path(os.environ.get(
+        "SWARPH_WATCHDOG_TOKEN_FILE",
+        "~/.config/swarph/watchdog-service.token")).expanduser()
+
+
+def _read_service_token() -> Optional[str]:
+    """The watchdog identity's token from its file, or None (absent /
+    unreadable / blank). The VALUE never hits logs — callers log only
+    whether one was found."""
+    try:
+        tok = _watchdog_service_token_path().read_text(
+            encoding="utf-8").strip()
+    except OSError:
+        return None
+    return tok or None
+
+
+def _write_service_token_file(path: Path, token: str) -> None:
+    """Write the token file 0600 (parents created). Refuses multiline
+    values — an env file line cannot hold them, and silently writing
+    half a credential is worse than failing."""
+    if "\n" in token:
+        raise ValueError("token contains a newline")
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(token.strip() + "\n", encoding="utf-8")
+    os.chmod(path, 0o600)
+
+
 def run_install_service(args: argparse.Namespace) -> int:
     """Install systemd timer + service for periodic watchdog --check.
 
@@ -1950,6 +2029,25 @@ def run_install_service(args: argparse.Namespace) -> int:
         1,
     )
 
+    # Card #1059/ruling_1332: template units run without the installer's
+    # env, so the unread check reads None and A1 stays inert (exit 7,
+    # opencode + cursor-lin measured live). The watchdog identity's
+    # token lives in a 0600 token FILE (path via SWARPH_WATCHDOG_TOKEN_FILE,
+    # default ~/.config/swarph/watchdog-service.token) — never in a unit,
+    # never in argv, never in the EnvironmentFile default. The installer
+    # writes it from its own env; rotation is re-running the install.
+    install_token = os.environ.get("MESH_GATEWAY_TOKEN")
+    token_path = _watchdog_service_token_path()
+    if install_token is not None and "\n" in install_token:
+        print("ERROR: MESH_GATEWAY_TOKEN contains a newline — refusing "
+              "to write the token file.", file=sys.stderr)
+        return 4
+    if not install_token:
+        print("WARNING: MESH_GATEWAY_TOKEN not in installer env — "
+              "template runs will exit 7 (noop_unread_unknown) until the "
+              f"token file exists at {token_path}; re-run --install-service "
+              "with it set.", file=sys.stderr)
+
     targets = [
         (_SYSTEMD_UNIT_DIR / service_name, service_content),
         (_SYSTEMD_UNIT_DIR / timer_name, timer_content),
@@ -1970,6 +2068,9 @@ def run_install_service(args: argparse.Namespace) -> int:
         for path, content in targets:
             print(f"\n# would write {path}:", file=sys.stderr)
             print(content, file=sys.stderr)
+        if install_token:
+            print(f"\n# would write {token_path} (0600, value not shown):",
+                  file=sys.stderr)
         if legacy_note:
             print(f"\n{legacy_note}", file=sys.stderr)
         print(
@@ -1992,7 +2093,10 @@ def run_install_service(args: argparse.Namespace) -> int:
         for path, content in targets:
             path.write_text(content, encoding="utf-8")
             print(f"wrote {path}", file=sys.stderr)
-    except (OSError, PermissionError) as exc:
+        if install_token:
+            _write_service_token_file(token_path, install_token)
+            print(f"wrote {token_path} (0600)", file=sys.stderr)
+    except (OSError, PermissionError, ValueError) as exc:
         print(f"ERROR: failed to write unit files: {exc}", file=sys.stderr)
         return 5
 

{swarph_cli-0.72.7 → swarph_cli-0.72.8/src/swarph_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: swarph-cli
-Version: 0.72.7
+Version: 0.72.8
 Summary: The `swarph` binary — a multi-LLM CLI and mesh-gateway client + bundled server (`swarph gateway`): one-shot prompts across providers, interactive `chat`, multi-provider `spawn` (claude/codex/antigravity via a ProviderMembrane with subprocess billing-scrub), `mesh` send/inbox/register, `brain-ask` over the swarph-brain (gbrain) semantic memory, git-backed `assisted_memory`, per-invocation `gh` identity routing, a silent DM-wake hook, session `import`, and a stranded-session `watchdog`.
 Author: Pierre Samson, Claude Opus
 License: MIT

{swarph_cli-0.72.7 → swarph_cli-0.72.8}/src/swarph_cli.egg-info/SOURCES.txt

@@ -195,6 +195,7 @@ tests/test_1013_spawn_channel.py
 tests/test_1017_muse_tui.py
 tests/test_1050_surrogate_wake.py
 tests/test_1052_opencode_deaf.py
+tests/test_1059_watchdog_unread_env.py
 tests/test_124_register_merge.py
 tests/test_126_pending_from_complete.py
 tests/test_132_ensure_monitor_state_dir.py

swarph_cli-0.72.8/tests/test_1059_watchdog_unread_env.py

@@ -0,0 +1,179 @@
+"""#1059 — template watchdog instances exit 7 (noop_unread_unknown):
+systemd units run without MESH_GATEWAY_TOKEN, so unread reads None and
+A1 stays permanently inert (opencode + cursor-lin, measured live).
+
+Fix: --install-service writes the installer's MESH_GATEWAY_TOKEN into
+the per-cell EnvironmentFile default (0600), never into the unit. The
+check itself is unchanged — it already reads the token from env.
+
+Seams: the dry-run preview (all three files print to stderr) for the
+install shape, and run_check with a stubbed urlopen for the replay
+(token flows into the Authorization header, unread is numeric, the
+stale-cursor + live-session + idle-pane shape yields the A1 path).
+"""
+from __future__ import annotations
+
+import io
+import json
+import os
+import urllib.request
+
+from swarph_cli.commands import watchdog as wd
+from swarph_cli.commands.watchdog import run_watchdog
+
+TOKEN = "tok-1059-test"
+
+
+def _dry_sections(capsys, monkeypatch, *, token=True):
+    if token:
+        monkeypatch.setenv("MESH_GATEWAY_TOKEN", TOKEN)
+    else:
+        monkeypatch.delenv("MESH_GATEWAY_TOKEN", raising=False)
+    rc = run_watchdog(argv=["--install-service", "--cell", "opencode",
+                            "--dry-run"])
+    assert rc == 0
+    err = capsys.readouterr().err
+    sections = {}
+    current = None
+    for line in err.splitlines():
+        if line.startswith("# would write "):
+            # Windows stringifies the target path with backslashes;
+            # normalize so the section match below holds everywhere.
+            current = line.replace("\\", "/")
+            sections[current] = []
+        elif current is not None:
+            sections[current].append(line)
+    return sections, err
+
+
+def test_install_writes_token_file_not_token_value(monkeypatch, capsys):
+    """With a token in env, the preview names the 0600 token file but
+    never shows the value — and no file section carries a token line."""
+    sections, err = _dry_sections(capsys, monkeypatch, token=True)
+    assert TOKEN not in err, "token value leaked into preview"
+    body = "\n".join(l for lines in sections.values() for l in lines)
+    assert "MESH_GATEWAY_TOKEN=" not in body
+    assert "0600" in err
+
+
+def test_install_never_puts_token_in_unit(monkeypatch, capsys):
+    """No token in ExecStart or anywhere in the .service content —
+    units are world-readable."""
+    sections, _ = _dry_sections(capsys, monkeypatch, token=True)
+    for key, lines in sections.items():
+        if key.endswith(".service:"):
+            assert TOKEN not in "\n".join(lines), key
+
+
+def test_token_file_round_trip_0600_and_newline_refused(monkeypatch, tmp_path):
+    """The helper writes the value with mode 600 and refuses multiline
+    values instead of writing half a credential."""
+    import stat
+    import sys
+    monkeypatch.setenv("SWARPH_WATCHDOG_TOKEN_FILE",
+                       str(tmp_path / "sub" / "watchdog-service.token"))
+    path = wd._watchdog_service_token_path()
+    wd._write_service_token_file(path, TOKEN)
+    assert path.read_text(encoding="utf-8") == TOKEN + "\n"
+    if sys.platform != "win32":  # POSIX file-mode bits not representable on Windows
+        assert stat.S_IMODE(path.stat().st_mode) == 0o600
+    assert wd._read_service_token() == TOKEN
+    try:
+        wd._write_service_token_file(path, "a\nb")
+    except ValueError:
+        pass
+    else:
+        raise AssertionError("multiline token accepted")
+    assert path.read_text(encoding="utf-8") == TOKEN + "\n"
+
+
+def test_install_without_token_warns_unread_blind(monkeypatch, capsys):
+    """No token in env: loud warning (template runs would exit 7 on
+    unread), and no token line minted anywhere."""
+    sections, err = _dry_sections(capsys, monkeypatch, token=False)
+    body = "\n".join(l for lines in sections.values() for l in lines)
+    assert "MESH_GATEWAY_TOKEN=" not in body
+    assert "unread" in err.lower()
+
+
+class _FakeResp:
+    def __init__(self, payload: bytes, status: int = 200):
+        self._payload = payload
+        self.status = status
+
+    def read(self):
+        return self._payload
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *exc):
+        return False
+
+
+def _rig_a1(monkeypatch, tmp_path, stub):
+    """Shared A1 replay rig: token in env, stale cursor, live session,
+    idle pane. Returns (run, seen) where run() executes the check."""
+    seen = {}
+    monkeypatch.setenv("MESH_GATEWAY_TOKEN", TOKEN)
+    monkeypatch.setattr(urllib.request, "urlopen", stub(seen))
+    cursor = tmp_path / "cursor.json"
+    cursor.write_text("{}")
+    os.utime(cursor, (7200, 7200))
+    monkeypatch.setattr(wd, "_tmux_session_exists", lambda name: True)
+    monkeypatch.setattr(wd, "_pane_activity_age_sec", lambda name: 99999.0)
+    monkeypatch.setattr(wd, "_tmux_send_keys", lambda *a, **k: True)
+    log = tmp_path / "watch.log"
+
+    def run(capsys):
+        rc = run_watchdog(argv=[
+            "--check", "--cell", "opencode", "--no-respawn", "--verbose",
+            f"--cursor={cursor}", "--tmux-session", "opencode",
+            "--peer", "opencode", "--gateway", "http://gw:1",
+            "--liveness-cmd", "true", f"--log={log}",
+            "--threshold", "60", "--pane-activity-threshold", "60"])
+        return rc, capsys.readouterr()
+    return run, seen
+
+
+def test_replay_token_env_yields_a1(monkeypatch, tmp_path, capsys):
+    """Accept replay: token in env, stale cursor, live session, idle
+    pane, count endpoint says 3 -> the A1 path with a numeric
+    unread_count — the Authorization header carries the token, and no
+    list query is ever made (no bodies cross the wire)."""
+    calls = []
+
+    def stub(seen):
+        def fake_urlopen(req, timeout=5):
+            seen["auth"] = req.get_header("Authorization")
+            calls.append(req.full_url)
+            return _FakeResp(json.dumps(
+                {"to_node": "opencode", "n": 3}).encode())
+        return fake_urlopen
+
+    run, seen = _rig_a1(monkeypatch, tmp_path, stub)
+    rc, out = run(capsys)
+    assert seen.get("auth") == f"Bearer {TOKEN}", seen
+    assert all("/messages/unread-count?" in u for u in calls), calls
+    assert '"decision": "a1_send_keys"' in out.out + out.err, out
+    assert '"unread_count": 3' in out.out + out.err, out
+    assert rc == 1
+
+
+def test_replay_count_404_falls_back_to_list(monkeypatch, tmp_path, capsys):
+    """Mixed fleet: gateway predates the count endpoint (404) -> the
+    client falls back to the list query rather than going blind."""
+    def stub(seen):
+        def fake_urlopen(req, timeout=5):
+            if req.full_url.startswith("http://gw:1/messages/unread-count?"):
+                raise urllib.error.HTTPError(
+                    req.full_url, 404, "nope", {}, None)
+            return _FakeResp(json.dumps(
+                {"messages": [{}, {}, {}]}).encode())
+        return fake_urlopen
+
+    run, _ = _rig_a1(monkeypatch, tmp_path, stub)
+    rc, out = run(capsys)
+    assert '"decision": "a1_send_keys"' in out.out + out.err, out
+    assert '"unread_count": 3' in out.out + out.err, out
+    assert rc == 1

{swarph_cli-0.72.7 → swarph_cli-0.72.8}/tests/test_watchdog.py

@@ -1108,6 +1108,7 @@ def test_gateway_unread_count_warns_loudly_when_token_missing(monkeypatch, capsy
     from swarph_cli.commands import watchdog
 
     class _FakeResp:
+        status = 200  # the transport seam reports status (404 = fall back)
         def __enter__(self): return self
         def __exit__(self, *a): return False
         def read(self): return b'{"messages": []}'
@@ -1126,6 +1127,7 @@ def test_gateway_unread_count_silent_when_token_present(monkeypatch, capsys):
     from swarph_cli.commands import watchdog
 
     class _FakeResp:
+        status = 200  # the transport seam reports status (404 = fall back)
         def __enter__(self): return self
         def __exit__(self, *a): return False
         def read(self): return b'{"messages": []}'