msapling-cli 0.1.2__tar.gz → 0.1.4__tar.gz

{msapling_cli-0.1.2 → msapling_cli-0.1.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: msapling-cli
-Version: 0.1.2
+Version: 0.1.4
 Summary: MSapling CLI - Multi-chat AI development environment in your terminal
 Author: MSapling Team
 License-Expression: MIT
@@ -31,9 +31,12 @@ Provides-Extra: keyring
 Requires-Dist: keyring>=24.0; extra == "keyring"
 Provides-Extra: tui
 Requires-Dist: textual>=0.40.0; extra == "tui"
+Provides-Extra: pdf
+Requires-Dist: pdfplumber>=0.10.0; extra == "pdf"
 Provides-Extra: all
 Requires-Dist: keyring>=24.0; extra == "all"
 Requires-Dist: textual>=0.40.0; extra == "all"
+Requires-Dist: pdfplumber>=0.10.0; extra == "all"
 Provides-Extra: dev
 Requires-Dist: build>=1.2.0; extra == "dev"
 Requires-Dist: pytest>=8.0; extra == "dev"

{msapling_cli-0.1.2 → msapling_cli-0.1.4}/msapling_cli/__init__.py

@@ -1,2 +1,2 @@
 """MSapling CLI - Multi-chat AI development environment in your terminal."""
-__version__ = "0.1.2"
+__version__ = "0.1.4"

{msapling_cli-0.1.2 → msapling_cli-0.1.4}/msapling_cli/agent.py

@@ -56,7 +56,10 @@ _permission_mode: str = "ask"
 _permissions: Dict[str, bool] = {}
 
 # Read-only tools that never require approval in any mode
-_READ_ONLY_TOOLS = frozenset({"read_file", "glob_files", "grep_search", "web_search", "cost_check"})
+_READ_ONLY_TOOLS = frozenset({
+    "read_file", "glob_files", "grep_search", "web_search", "web_fetch",
+    "cost_check", "list_directory", "ask_user", "todo_list",
+})
 
 # Write tools blocked in readonly/plan mode
 _WRITE_TOOLS = frozenset({"write_file", "edit_file", "run_command"})
@@ -131,6 +134,31 @@ AGENT_TOOLS_SCHEMA = [
         "description": "Search the web for current information. Uses MSapling's backend search. Use when the user asks about recent events, documentation, or anything that might be outdated in your training data.",
         "parameters": {"query": "string (search query)"},
     },
+    {
+        "name": "web_fetch",
+        "description": "Fetch the content of a specific URL. Returns the page text (HTML stripped). Use for reading documentation, API references, or specific web pages.",
+        "parameters": {"url": "string (full URL to fetch)"},
+    },
+    {
+        "name": "list_directory",
+        "description": "List files and directories at a path with sizes and types. More detailed than glob_files.",
+        "parameters": {"path": "string (relative directory path, default '.')"},
+    },
+    {
+        "name": "ask_user",
+        "description": "Ask the user a clarifying question when you need more information to proceed. Use sparingly — only when truly ambiguous.",
+        "parameters": {"question": "string (the question to ask)"},
+    },
+    {
+        "name": "todo_list",
+        "description": "Manage a task checklist for the current session. Use to plan multi-step work and track progress.",
+        "parameters": {"action": "string ('add', 'done', 'list', 'clear')", "item": "string (task description, for 'add' and 'done')"},
+    },
+    {
+        "name": "search_replace_all",
+        "description": "Replace ALL occurrences of a string in a file (not just the first). Use when renaming a variable or updating all imports.",
+        "parameters": {"path": "string (relative file path)", "old_string": "string (text to find)", "new_string": "string (replacement)"},
+    },
     {
         "name": "cost_check",
         "description": "Check the user's remaining fuel credits and session cost before expensive operations. Use this before large file writes or multi-step tasks.",
@@ -157,17 +185,22 @@ To use a tool, respond with a JSON block in this format:
 ```
 
 Available tools:
-- read_file: Read a file. Args: path, offset (optional), limit (optional)
+- read_file: Read a file (supports text, PDF, notebooks). Args: path, offset (optional), limit (optional)
 - write_file: Create/overwrite a file. Args: path, content
-- edit_file: Replace a specific string in a file. Args: path, old_string, new_string
+- edit_file: Replace first occurrence of a string. Args: path, old_string, new_string
+- search_replace_all: Replace ALL occurrences in a file. Args: path, old_string, new_string
 - run_command: Execute a shell command. Args: command
+- list_directory: List files with sizes and types. Args: path (default ".")
 - glob_files: Find files by pattern. Args: pattern
 - grep_search: Search file contents. Args: pattern, path (optional)
 - web_search: Search the web via MSapling backend. Args: query
-- cost_check: Check remaining fuel credits and session cost. No args.
-- model_switch: Switch to a different model mid-task. Args: model (e.g. "google/gemini-2.0-flash-001")
+- web_fetch: Fetch content of a specific URL. Args: url
+- ask_user: Ask the user a clarifying question. Args: question
+- todo_list: Manage task checklist. Args: action (add/done/list/clear), item
+- cost_check: Check remaining fuel credits. No args.
+- model_switch: Switch model mid-task. Args: model
 
-Cost tips: Use cost_check before expensive multi-step tasks. Use model_switch to use cheaper models for boilerplate.
+Tips: Use cost_check before expensive tasks. Use model_switch for cheaper models on grunt work. Use search_replace_all for renaming variables across a file.
 
 You can use multiple tools in one response. After tool results, continue reasoning.
 When you're done (no more tools needed), just respond with your final message.
@@ -356,17 +389,103 @@ def _web_search(query: str) -> str:
         return f"Web search error: {e}"
 
 
+# ─── Command Sandbox ─────────────────────────────────────────────────
+# Block dangerous command patterns. Not OS-level but catches common mistakes.
+
+_BLOCKED_COMMAND_PATTERNS = [
+    r"\brm\s+(-[rRf]+\s+)?/",           # rm -rf /
+    r"\brm\s+-[rRf]*\s+~",              # rm -rf ~
+    r"\brm\s+-[rRf]*\s+\.\.",           # rm -rf ..
+    r"\bsudo\b",                          # sudo anything
+    r"\bchmod\s+777\b",                  # chmod 777
+    r"\bchmod\s+-R\b",                   # chmod -R (recursive)
+    r"\bmkfs\b",                          # format filesystem
+    r"\bdd\s+if=",                       # dd disk write
+    r"\b:()\s*\{",                        # fork bomb
+    r"\bcurl\b.*\|\s*bash",             # curl | bash
+    r"\bwget\b.*\|\s*bash",            # wget | bash
+    r"\bcurl\b.*\|\s*sh",              # curl | sh
+    r"\bwget\b.*\|\s*sh",             # wget | sh
+    r">\s*/dev/sd",                      # write to disk device
+    r"\bshutdown\b",                     # shutdown
+    r"\breboot\b",                       # reboot
+    r"\bkill\s+-9\s+1\b",              # kill init
+    r"\biptables\b",                     # firewall rules
+    r"\bufw\b",                          # firewall
+]
+
+_sandbox_enabled: bool = True
+
+
+def _check_command_sandbox(command: str) -> Optional[str]:
+    """Check if a command is blocked by the sandbox. Returns error message or None."""
+    if not _sandbox_enabled:
+        return None
+    cmd_lower = command.lower().strip()
+    for pattern in _BLOCKED_COMMAND_PATTERNS:
+        if re.search(pattern, cmd_lower):
+            return f"Blocked by sandbox: '{command[:60]}' matches dangerous pattern. Use /sandbox off to disable."
+    return None
+
+
+def set_sandbox(enabled: bool) -> bool:
+    global _sandbox_enabled
+    _sandbox_enabled = enabled
+    return _sandbox_enabled
+
+
+# Strong references to background tasks so they don't get GC'd mid-flight.
+# See: https://docs.python.org/3/library/asyncio-task.html#creating-tasks
+_background_tasks: set = set()
+
+# Agent todo list (managed via todo_list tool)
+_agent_todos: List[Dict[str, Any]] = []
+
+
+def _mdrive_auto_push(project_root: str, rel_path: str, content: str, project_name: str = "", agent_id: str = "cli-agent"):
+    """Background push to MDrive after local file write. Best-effort, non-blocking."""
+    if not project_name:
+        return
+    try:
+        import asyncio as _aio
+        from .api import MSaplingClient
+
+        async def _push():
+            client = MSaplingClient()
+            try:
+                await client.mdrive_write(
+                    project_name, rel_path, content,
+                    agent_id=agent_id,
+                    change_summary="Auto-pushed by agent tool",
+                )
+            finally:
+                await client.close()
+
+        try:
+            loop = _aio.get_running_loop()
+            task = loop.create_task(_push())
+            # Hold strong reference until task completes
+            _background_tasks.add(task)
+            task.add_done_callback(_background_tasks.discard)
+        except RuntimeError:
+            _aio.run(_push())
+    except Exception:
+        pass  # Best-effort, never block the agent
+
+
 def _execute_tool(
     tool_name: str,
     args: Dict[str, Any],
     project_root: str,
     hooks_mgr: Any = None,
     model: str = "",
+    project_name: str = "",
 ) -> str:
     """Execute a single tool call locally. Returns result as string.
 
     When *hooks_mgr* is provided (a HooksManager), the function fires
     *on_file_write* hooks after a successful write_file or edit_file.
+    When *project_name* is set, auto-pushes written files to MDrive.
     """
 
     # --- Approval gate for mutating tools ---
@@ -382,7 +501,47 @@ def _execute_tool(
         if not fpath.is_file():
             return f"Error: file not found: {path}"
         try:
-            content = fpath.read_text(encoding="utf-8", errors="ignore")
+            ext = fpath.suffix.lower()
+
+            # PDF reading
+            if ext == ".pdf":
+                try:
+                    import pdfplumber
+                    text_parts = []
+                    with pdfplumber.open(fpath) as pdf:
+                        for i, page in enumerate(pdf.pages[:30]):
+                            page_text = page.extract_text() or ""
+                            if page_text.strip():
+                                text_parts.append(f"--- Page {i+1} ---\n{page_text}")
+                    content = "\n\n".join(text_parts) if text_parts else "(no extractable text)"
+                except ImportError:
+                    return "Error: PDF reading requires pdfplumber. Install: pip install pdfplumber"
+
+            # Jupyter notebook reading
+            elif ext == ".ipynb":
+                try:
+                    nb = json.loads(fpath.read_text(encoding="utf-8"))
+                    cells = nb.get("cells", [])
+                    parts = []
+                    for i, cell in enumerate(cells):
+                        cell_type = cell.get("cell_type", "code")
+                        source = "".join(cell.get("source", []))
+                        if cell_type == "markdown":
+                            parts.append(f"[Markdown cell {i+1}]\n{source}")
+                        else:
+                            parts.append(f"[Code cell {i+1}]\n```\n{source}\n```")
+                            outputs = cell.get("outputs", [])
+                            for out in outputs[:3]:
+                                if "text" in out:
+                                    parts.append("Output: " + "".join(out["text"])[:500])
+                    content = "\n\n".join(parts)
+                except Exception as e:
+                    return f"Error parsing notebook: {e}"
+
+            # Standard text file
+            else:
+                content = fpath.read_text(encoding="utf-8", errors="ignore")
+
             offset = int(args.get("offset", 0))
             limit = int(args.get("limit", 0))
             if offset or limit:
@@ -411,6 +570,8 @@ def _execute_tool(
                     project=project_root, model=model,
                     file=str(fpath), tool="write_file",
                 )
+            # Auto-push to MDrive (best-effort, non-blocking)
+            _mdrive_auto_push(project_root, path, content, project_name)
             return f"Wrote {len(content)} bytes to {path}"
         except Exception as e:
             return f"Error writing {path}: {e}"
@@ -431,7 +592,9 @@ def _execute_tool(
             # Backup before editing (like Claude Code's file-history)
             try:
                 from .storage import backup_file
-                backup_file(path, content, "agent")
+                import hashlib
+                session_key = hashlib.md5(project_root.encode()).hexdigest()[:12]
+                backup_file(path, content, session_key)
             except Exception:
                 pass
             new_content = content.replace(old_string, new_string, 1)
@@ -442,6 +605,8 @@ def _execute_tool(
                     project=project_root, model=model,
                     file=str(fpath), tool="edit_file",
                 )
+            # Auto-push to MDrive (best-effort, non-blocking)
+            _mdrive_auto_push(project_root, path, new_content, project_name)
             return f"Edited {path}: replaced {len(old_string)} chars with {len(new_string)} chars"
         except Exception as e:
             return f"Error editing {path}: {e}"
@@ -450,10 +615,14 @@ def _execute_tool(
         command = args.get("command", "")
         if not command:
             return "Error: no command provided"
+        # Sandbox check: block dangerous patterns
+        blocked = _check_command_sandbox(command)
+        if blocked:
+            return blocked
         try:
             result = subprocess.run(
                 command, shell=True, cwd=project_root,
-                capture_output=True, text=True, timeout=30,
+                capture_output=True, text=True, timeout=60,
             )
             output = ""
             if result.stdout:
@@ -463,7 +632,7 @@ def _execute_tool(
             output += f"\n(exit code: {result.returncode})"
             return output or "(no output)"
         except subprocess.TimeoutExpired:
-            return "Error: command timed out (30s limit)"
+            return "Error: command timed out (60s limit)"
         except Exception as e:
             return f"Error running command: {e}"
 
@@ -511,11 +680,138 @@ def _execute_tool(
             return "Error: no search query provided"
         return _web_search(query)
 
-    elif tool_name == "cost_check":
+    elif tool_name == "web_fetch":
+        url = args.get("url", "")
+        if not url:
+            return "Error: no URL provided"
         try:
+            # Try backend first, fall back to direct fetch
             from .config import get_settings, get_token
+            import httpx as _httpx
+            settings = get_settings()
+            api_url = settings.api_url.rstrip("/")
+            token = get_token()
+            cookies = {"msaplingauth": token} if token else {}
+            try:
+                resp = _httpx.post(
+                    f"{api_url}/api/tools/web-research",
+                    json={"url": url}, cookies=cookies, timeout=15.0,
+                )
+                if resp.status_code == 200:
+                    content = resp.json().get("content", resp.json().get("text", ""))
+                    if content and len(content) > 20:
+                        return content[:8000]
+            except Exception:
+                pass
+            # Direct fetch fallback
+            resp = _httpx.get(url, timeout=15.0, follow_redirects=True,
+                              headers={"User-Agent": "MSapling-CLI/0.2"})
+            text = resp.text
+            # Strip HTML tags for readability
+            text = re.sub(r"<script[^>]*>.*?</script>", "", text, flags=re.DOTALL)
+            text = re.sub(r"<style[^>]*>.*?</style>", "", text, flags=re.DOTALL)
+            text = re.sub(r"<[^>]+>", " ", text)
+            text = re.sub(r"\s+", " ", text).strip()
+            return text[:8000] if text else "No content found"
+        except Exception as e:
+            return f"Error fetching URL: {e}"
+
+    elif tool_name == "list_directory":
+        dir_path = args.get("path", ".")
+        fpath = _safe_path(project_root, dir_path)
+        if not fpath:
+            return f"Error: path '{dir_path}' is outside project root"
+        if not fpath.is_dir():
+            return f"Error: not a directory: {dir_path}"
+        try:
+            skip = {".git", "node_modules", "__pycache__", "venv", ".venv", "dist", "build"}
+            entries = []
+            for item in sorted(fpath.iterdir()):
+                name = item.name
+                if name in skip:
+                    continue
+                if item.is_dir():
+                    entries.append(f"  {name}/")
+                else:
+                    size = item.stat().st_size
+                    size_str = f"{size / 1024:.1f}KB" if size > 1024 else f"{size}B"
+                    entries.append(f"  {name}  ({size_str})")
+                if len(entries) >= 80:
+                    entries.append(f"  ... (truncated)")
+                    break
+            return "\n".join(entries) if entries else "(empty directory)"
+        except Exception as e:
+            return f"Error: {e}"
+
+    elif tool_name == "ask_user":
+        question = args.get("question", "")
+        if not question:
+            return "Error: no question provided"
+        try:
+            console.print(f"\n[bold yellow]Agent asks:[/bold yellow] {question}")
+            answer = console.input("[bold green]Your answer:[/bold green] ")
+            return answer.strip() or "(no answer)"
+        except (KeyboardInterrupt, EOFError):
+            return "(user declined to answer)"
+
+    elif tool_name == "todo_list":
+        action = args.get("action", "list").lower()
+        item = args.get("item", "")
+        # Module-level todo storage
+        global _agent_todos
+        if action == "add" and item:
+            _agent_todos.append({"text": item, "done": False})
+            return f"Added: {item} ({len(_agent_todos)} total)"
+        elif action == "done" and item:
+            for t in _agent_todos:
+                if item.lower() in t["text"].lower() and not t["done"]:
+                    t["done"] = True
+                    return f"Completed: {t['text']}"
+            return f"Not found: {item}"
+        elif action == "clear":
+            _agent_todos.clear()
+            return "Todo list cleared"
+        else:
+            if not _agent_todos:
+                return "Todo list is empty"
+            lines = []
+            for i, t in enumerate(_agent_todos, 1):
+                mark = "x" if t["done"] else " "
+                lines.append(f"  [{mark}] {i}. {t['text']}")
+            return "\n".join(lines)
+
+    elif tool_name == "search_replace_all":
+        path = args.get("path", "")
+        old_string = args.get("old_string", "")
+        new_string = args.get("new_string", "")
+        fpath = _safe_path(project_root, path)
+        if not fpath:
+            return f"Error: path '{path}' is outside project root"
+        if not fpath.is_file():
+            return f"Error: file not found: {path}"
+        try:
+            content = fpath.read_text(encoding="utf-8", errors="ignore")
+            count = content.count(old_string)
+            if count == 0:
+                return f"Error: string not found in {path}"
+            try:
+                from .storage import backup_file
+                import hashlib
+                session_key = hashlib.md5(project_root.encode()).hexdigest()[:12]
+                backup_file(path, content, session_key)
+            except Exception:
+                pass
+            new_content = content.replace(old_string, new_string)
+            fpath.write_text(new_content, encoding="utf-8")
+            _mdrive_auto_push(project_root, path, new_content, project_name)
+            return f"Replaced {count} occurrence(s) in {path}"
+        except Exception as e:
+            return f"Error: {e}"
+
+    elif tool_name == "cost_check":
+        try:
             from .api import MSaplingClient
-            import asyncio as _asyncio
+            import concurrent.futures
 
             async def _check():
                 client = MSaplingClient()
@@ -531,7 +827,11 @@ def _execute_tool(
                 finally:
                     await client.close()
 
-            return _asyncio.get_event_loop().run_until_complete(_check())
+            # _execute_tool is sync but called from within a running event loop.
+            # Use a thread to avoid "event loop already running" RuntimeError.
+            with concurrent.futures.ThreadPoolExecutor(max_workers=1) as pool:
+                result = pool.submit(asyncio.run, _check()).result(timeout=10)
+            return result
         except Exception as e:
             return f"Cost check error: {e}"
 
@@ -566,6 +866,8 @@ async def run_agent_loop(
     on_text: Any = None,
     on_usage: Any = None,
     hooks_mgr: Any = None,
+    project_name: str = "",
+    chat_id: str = "",
 ) -> str:
     """Run the agentic tool-use loop.
 
@@ -600,9 +902,10 @@ async def run_agent_loop(
         # Get LLM response
         parts = []
         async for chunk in client.stream_chat(
-            chat_id=str(uuid.uuid4())[:12],
+            chat_id=chat_id or str(uuid.uuid4())[:12],
             prompt=prompt if step == 0 else "",
             model=model,
+            project_name=project_name,
             history=messages[-30:],  # Keep recent context
         ):
             content = chunk.get("content", "")
@@ -648,6 +951,7 @@ async def run_agent_loop(
             result = _execute_tool(
                 tool_name, tool_args, project_root,
                 hooks_mgr=hooks_mgr, model=model,
+                project_name=project_name,
             )
 
             # on_after_tool hook