expluro 0.2.0__tar.gz → 0.3.1__tar.gz

{expluro-0.2.0 → expluro-0.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: expluro
-Version: 0.2.0
+Version: 0.3.1
 Summary: Expluro CLI — graph layer on top of your AI agent
 Requires-Python: >=3.10
 Requires-Dist: claude-agent-sdk>=0.0.1

{expluro-0.2.0 → expluro-0.3.1}/expluro.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: expluro
-Version: 0.2.0
+Version: 0.3.1
 Summary: Expluro CLI — graph layer on top of your AI agent
 Requires-Python: >=3.10
 Requires-Dist: claude-agent-sdk>=0.0.1

{expluro-0.2.0 → expluro-0.3.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "expluro"
-version = "0.2.0"
+version = "0.3.1"
 description = "Expluro CLI — graph layer on top of your AI agent"
 requires-python = ">=3.10"
 dependencies = [

{expluro-0.2.0 → expluro-0.3.1}/topo/capture.py

@@ -27,6 +27,7 @@ from .constants import APP_DIR
 if TYPE_CHECKING:
     from .backend import BackendClient
     from .drivers.base import BaseDriver, DriverEvent, ToolHookPayload
+    from .snapshot import SnapshotManager
 
 logger = logging.getLogger(__name__)
 
@@ -56,10 +57,16 @@ class EventCapture:
         backend: "BackendClient",
         graph_id: str,
         node_id: str,
+        snapshot_manager: "SnapshotManager | None" = None,
     ) -> None:
         self._backend = backend
         self._graph_id = graph_id
         self._node_id = node_id
+        # Optional — when present, every side-effecting tool call gets a
+        # filesystem snapshot committed to a shadow git repo and the resulting
+        # commit hash + diff summary attached to the post_tool_use event.
+        # Powers `/branch` and `/checkout` filesystem rewind.
+        self._snapshot_manager: "SnapshotManager | None" = snapshot_manager
         self._last_event_id: str | None = None
         # Accumulated streaming text for the current turn.
         # Flushed as message_ai on turn_result if text_complete never fires
@@ -297,16 +304,44 @@ class EventCapture:
 
     async def _on_post_tool(self, payload: "ToolHookPayload") -> None:
         is_side_effecting = payload.tool_name in SIDE_EFFECTING_TOOLS
+
+        # Snapshot the filesystem after a side-effecting tool. Even tools we
+        # think are read-only sometimes touch state (e.g. Bash that runs a
+        # build, Grep with --rewrite), so we let the SnapshotManager dedupe:
+        # if nothing changed, the commit is a no-op and returns the existing
+        # HEAD hash. Diff summary is attached to the event for browser display.
+        snapshot_hash: str | None = None
+        diff_summary: dict | None = None
+        if is_side_effecting and self._snapshot_manager is not None:
+            try:
+                snapshot_hash, diff_summary = await self._snapshot_manager.commit(
+                    label=f"{payload.tool_name} {payload.tool_use_id[:8]}",
+                )
+            except Exception:
+                logger.exception("snapshot commit failed for %s", payload.tool_name)
+
+        event_data: dict[str, Any] = {
+            "tool_output": _truncate(payload.tool_output),
+            "is_error": payload.is_error,
+            "is_side_effecting": is_side_effecting,
+        }
+        if snapshot_hash:
+            event_data["snapshot_hash"] = snapshot_hash
+        if diff_summary:
+            event_data["diff_summary"] = diff_summary
+
         event = self._build_event(
             event_type="post_tool_use",
             tool_name=payload.tool_name,
             tool_use_id=payload.tool_use_id,
-            data={
-                "tool_output": _truncate(payload.tool_output),
-                "is_error": payload.is_error,
-                "is_side_effecting": is_side_effecting,
-            },
+            data=event_data,
         )
+        # The Event model has a snapshot_hash field — the backend pulls it
+        # from the top level of the request payload, not from `data`. Set it
+        # here so it lands in the indexed column, not just the JSON blob.
+        if snapshot_hash:
+            event["snapshot_hash"] = snapshot_hash
+
         if self._pending_user_message_text is not None:
             self._buffered_hook_events.append(event)
             return

{expluro-0.2.0 → expluro-0.3.1}/topo/drivers/_branch_detection.py

@@ -83,8 +83,64 @@ def parse_branch_flag(buffered_head: str) -> tuple[float | None, str]:
     Returns (confidence, remaining_text). When the head doesn't start with
     a valid tag, confidence is None and the entire buffered_head is
     returned as remaining_text — caller should treat it as regular content.
+
+    If the tag matches structurally but the digits are malformed (e.g.
+    `<!--BRANCH:.-->`), we still consume the tag bytes from the remaining
+    text but return None for confidence. That way a weird model emission
+    can't leak the tag to the user OR crash the dispatcher.
     """
     m = BRANCH_FLAG_START_RE.match(buffered_head)
-    if m:
-        return float(m.group(1)), buffered_head[m.end():]
-    return None, buffered_head
+    if not m:
+        return None, buffered_head
+    try:
+        confidence = float(m.group(1))
+    except ValueError:
+        return None, buffered_head[m.end():]
+    return confidence, buffered_head[m.end():]
+
+
+def strip_all_branch_tags(text: str) -> tuple[float | None, str]:
+    """Strip every leading BRANCH tag from `text` and return (confidence, rest).
+
+    Defensive against three model misbehaviours, in one place so every
+    driver inherits the same protection:
+
+      - **Multiple stacked tags** — e.g. `<!--BRANCH:0.0--><!--BRANCH:0.5-->Hi`.
+        We loop `parse_branch_flag` and strip them all; the *first*
+        confidence wins (subsequent tags are usually a model emitting
+        the marker more than once, not actually multiple decisions).
+
+      - **Partial tag at end** — e.g. `<!--BRANCH:0.5` with no closing
+        `-->`. Happens when a tool call interrupts a tag stream. We drop
+        the partial-tag bytes so they don't leak into rendered text.
+
+      - **Malformed digits** — handled inside `parse_branch_flag`
+        (the tag is consumed silently, no confidence reported).
+
+    Returns the first valid confidence found (or None if no parseable
+    tag was at the head), and the remaining text after all leading tags
+    are stripped (or empty string if the remaining content was a
+    partial-tag prefix).
+    """
+    first_confidence: float | None = None
+    buf = text
+    while True:
+        confidence, rest = parse_branch_flag(buf)
+        if confidence is None and rest == buf:
+            # No tag matched at all — buf is plain content.
+            break
+        # A tag was consumed (confidence may still be None if the tag's
+        # digits were malformed). Capture the first valid confidence.
+        if first_confidence is None and confidence is not None:
+            first_confidence = confidence
+        buf = rest
+        if not buf:
+            break
+
+    # If the buffer is now a partial tag prefix (no closing `-->`),
+    # the model started a tag we never saw the end of. Drop it
+    # rather than leak `<!--BRANCH:0.5` to the renderer.
+    if buf.startswith("<!--BRANCH:") and "-->" not in buf:
+        buf = ""
+
+    return first_confidence, buf

{expluro-0.2.0 → expluro-0.3.1}/topo/drivers/_permissions.py

@@ -18,6 +18,7 @@ from __future__ import annotations
 import logging
 from dataclasses import dataclass, field
 from enum import Enum
+from html import escape as _html_escape
 from typing import Any
 
 logger = logging.getLogger(__name__)
@@ -72,24 +73,44 @@ async def ask_user_for_permission(
     """
     # Late imports to avoid cycles with picker / renderer at module-load time.
     from ..picker import pick_option
-    from ..renderer import pause_active_spinner, resume_active_spinner
+    from ..renderer import (
+        pause_active_md_stream,
+        pause_active_spinner,
+        resume_active_spinner,
+    )
+
+    # prompt_toolkit's HTML(...) is strict XML; any literal `&`, `<`, `>`
+    # or quote in agent-provided text (Kiro tool titles like
+    # "Run command: cat /etc/hosts 2>&1" — note the bare `&`) crashes the
+    # picker with an ExpatError, the wrapper deny-fails closed, and the
+    # user sees no prompt at all. Escape user/agent-provided substrings
+    # before embedding them inside our HTML-formatted picker text.
+    safe_tool_name = _html_escape(tool_name)
+    safe_summary = _html_escape(summary) if summary else ""
 
     summary_line = (
-        f"\n  <ansibrightblack>  {summary}</ansibrightblack>" if summary else ""
+        f"\n  <ansibrightblack>  {safe_summary}</ansibrightblack>" if safe_summary else ""
     )
     header = (
-        f"  <ansicyan>⚙ {tool_name}</ansicyan>  "
+        f"  <ansicyan>⚙ {safe_tool_name}</ansicyan>  "
         f"<ansibrightblack>wants to run:</ansibrightblack>{summary_line}"
     )
 
     options: list[tuple[str, str]] = [
         ("Allow", "allow"),
-        (f"Always allow {tool_name}", "always"),
+        (f"Always allow {safe_tool_name}", "always"),
         ("Deny", "deny"),
         ("Bypass all checks", "bypass"),
     ]
 
+    # Hand the terminal off to prompt_toolkit cleanly: stop the spinner and
+    # flush+stop any active rich.Live markdown stream. If we skip the
+    # md-stream flush, an in-progress streaming response will keep
+    # repainting the cursor area on every refresh tick and the picker is
+    # invisible — the user thinks the agent went silent, but the agent is
+    # actually waiting on an approval that never gets a chance to render.
     pause_active_spinner()
+    pause_active_md_stream()
     try:
         result = await pick_option(header, options)
     except KeyboardInterrupt: