ata-coder 2.4.7__tar.gz → 2.4.8__tar.gz

{ata_coder-2.4.7/ata_coder.egg-info → ata_coder-2.4.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ata-coder
-Version: 2.4.7
+Version: 2.4.8
 Summary: ATA Coder — AI-powered coding assistant
 Author: ATA Coder Team
 License-Expression: MIT

{ata_coder-2.4.7 → ata_coder-2.4.8}/agent.py

@@ -142,6 +142,10 @@ class CoderAgent(CompactionMixin, ToolExecutionMixin,
         self.self_correct = SelfCorrectionEngine(max_retries=1)
         self.git = GitWorkflow(self.tools.workspace)
 
+        # Per-instance self-correction depth (was a class variable shared across
+        # all agent instances — dangerous under ThreadingHTTPServer in server mode).
+        self._self_correct_depth: int = 0
+
         self._state = AgentState()
         self._on_event: Callable[[AgentEvent], None] | None = None
         self._current_session_id: str = ""

{ata_coder-2.4.7 → ata_coder-2.4.8}/agent_tools.py

@@ -17,7 +17,8 @@ class ToolExecutionMixin:
     # ── Tool execution ────────────────────────────────────────────────────
 
     # Guard depth for self-correction retry — prevents infinite recursion.
-    _self_correct_depth: int = 0
+    # These are set as INSTANCE variables in CoderAgent.__init__ to avoid
+    # cross-session contamination under ThreadingHTTPServer (server mode).
     _MAX_SELF_CORRECT_DEPTH: int = 1
 
     async def _execute_tool(self, tool_name: str, arguments: dict[str, Any]) -> ToolResult:

{ata_coder-2.4.7 → ata_coder-2.4.8/ata_coder.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ata-coder
-Version: 2.4.7
+Version: 2.4.8
 Summary: ATA Coder — AI-powered coding assistant
 Author: ATA Coder Team
 License-Expression: MIT

{ata_coder-2.4.7 → ata_coder-2.4.8}/change_tracker.py

@@ -143,7 +143,7 @@ class ChangeTracker:
                     old_content = f.read()
                 self._backup(file_path)
             except Exception:
-                pass
+                logger.debug("Failed to read/backup existing file %s", file_path, exc_info=True)
 
         change = FileChange(
             id=self._next_id,

{ata_coder-2.4.7 → ata_coder-2.4.8}/config.py

@@ -197,17 +197,21 @@ class AppConfig:
 # Using a lazy pattern because AppConfig.load() references _from_settings()
 # which is defined after the dataclass body in this module.
 _config: AppConfig | None = None
+_config_lock = threading.Lock()
 
 
 def get_config() -> AppConfig:
     """Return the module-level config singleton (lazy init on first call).
 
-    After the first call the config is cached.  The codebase is
-    single-threaded by design so no lock is needed.
+    After the first call the config is cached.  Double-checked locking
+    protects the lazy-init path when server.py runs under ThreadingHTTPServer
+    (where multiple threads may race on the first call).
     """
     global _config
     if _config is None:
-        _config = AppConfig.load()
+        with _config_lock:
+            if _config is None:  # double-check
+                _config = AppConfig.load()
     return _config
 
 

{ata_coder-2.4.7 → ata_coder-2.4.8}/main.py

@@ -44,7 +44,7 @@ if sys.platform == 'win32':
         _patched_init.__ata_patched__ = True
         _sp.Popen.__init__ = _patched_init
 
-__version__ = "2.4.7"
+__version__ = "2.4.8"
 
 import asyncio
 import logging
@@ -90,12 +90,12 @@ def _signal_handler(sig, frame):
     try:
         get_clawd().shutdown()
     except Exception:
-        pass
+        logger.debug("Clawd shutdown failed during signal handler", exc_info=True)
     for handler in _cleanup_handlers:
         try:
             handler()
         except Exception:
-            pass
+            logger.debug("Cleanup handler %s failed", handler, exc_info=True)
     sys.exit(1)
 
 

{ata_coder-2.4.7 → ata_coder-2.4.8}/memory.py

@@ -97,6 +97,9 @@ class Memory:
     @classmethod
     def from_frontmatter(cls, raw: str) -> "Memory | None":
         """Parse a markdown file with YAML frontmatter into a Memory."""
+        # Non-greedy match for the frontmatter separator; uses a negative
+        # lookahead to ensure we match the FIRST closing --- (avoiding false
+        # matches on YAML separators inside code blocks in the body).
         match = re.match(r"^---\s*\n(.*?)\n---\s*\n(.*)", raw, re.DOTALL)
         if not match:
             return None

{ata_coder-2.4.7 → ata_coder-2.4.8}/privilege.py

@@ -167,15 +167,19 @@ def wrap_privileged_command(command: str) -> str:
         )
 
     elif os_family == OSFamily.WINDOWS:
-        # Encode command as base64 (utf-16-le) to avoid escaping nightmares
-        # in PowerShell's nested quoting.  Use subprocess-style argument list
-        # rather than string interpolation to prevent command injection.
+        # Encode the entire command as a single base64 PowerShell script to
+        # avoid nested-quoting injection through cmd.exe.  The script is
+        # executed directly by PowerShell without going through cmd.exe at all,
+        # which eliminates the shlex.quote / cmd.exe quoting mismatch.
+        # We embed the base64 script in a here-string so that special
+        # characters ($, `, ", etc.) in the original command are harmless.
         encoded = base64.b64encode(command.encode("utf-16-le")).decode()
-        inner_cmd = f"/c powershell -EncodedCommand {encoded}"
+        # Use PowerShell -EncodedCommand directly (no cmd.exe intermediary)
         return (
             'powershell -Command "'
-            'Start-Process -Verb RunAs -Wait -FilePath cmd.exe '
-            f'-ArgumentList {shlex.quote(inner_cmd)}"'
+            'Start-Process -Verb RunAs -Wait -FilePath powershell.exe '
+            f'-ArgumentList \\"-NoProfile -EncodedCommand {encoded}\\"'
+            '"'
         )
 
     return command

{ata_coder-2.4.7 → ata_coder-2.4.8}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ata-coder"
-version = "2.4.7"
+version = "2.4.8"
 description = "ATA Coder — AI-powered coding assistant"
 readme = "README.md"
 requires-python = ">=3.10"

{ata_coder-2.4.7 → ata_coder-2.4.8}/safety_guard.py

@@ -114,7 +114,7 @@ DESTRUCTIVE_PATTERNS = [
     (r">\s*/dev/sd", RiskLevel.CRITICAL, "Direct disk write"),
     (r">\s*/dev/nvme", RiskLevel.CRITICAL, "Direct NVMe write"),
     (r"\bshred\s+", RiskLevel.DANGER, "Secure file deletion"),
-    (r"\$\(.*\)", RiskLevel.CAUTION, "Command substitution detected"),
+    (r"\$\([^)]+\)", RiskLevel.CAUTION, "Command substitution detected"),
     (r"`[^`]+`", RiskLevel.CAUTION, "Backtick command substitution detected"),
     (r"chmod\s+777\s+/", RiskLevel.CRITICAL, "World-writable root"),
     (r"chmod\s+-R\s+777\s+/", RiskLevel.CRITICAL, "World-writable root recursive"),

{ata_coder-2.4.7 → ata_coder-2.4.8}/server.py

@@ -70,12 +70,12 @@ class ThreadingHTTPServer(ThreadingMixIn, HTTPServer):
                         b"",
                     ]))
                 except Exception:
-                    pass
+                    logger.debug("Failed to send 503 response", exc_info=True)
                 finally:
                     try:
                         request.close()
                     except Exception:
-                        pass
+                        logger.debug("Failed to close rejected request socket", exc_info=True)
                 return
             # Atomic read-modify-write under lock (was: bare GIL-only read+write)
             self._active_threads += 1
@@ -83,6 +83,10 @@ class ThreadingHTTPServer(ThreadingMixIn, HTTPServer):
             super().process_request(request, client_address)
         finally:
             with self._thread_lock:
+                if self._active_threads <= 0:
+                    logger.error("Thread counter underflow! _active_threads=%d — "
+                               "a decrement was matched to no increment, indicating "
+                               "a bug in process_request pairing.", self._active_threads)
                 self._active_threads = max(0, self._active_threads - 1)
 from pathlib import Path
 from typing import Any

{ata_coder-2.4.7 → ata_coder-2.4.8}/server_session.py

@@ -45,7 +45,7 @@ class SessionStore:
             try:
                 asyncio.run(agent.shutdown())
             except Exception:
-                pass
+                logger.debug("Agent shutdown via asyncio.run() failed", exc_info=True)
             return
         # Event loop is running — schedule on it via thread-safe mechanism
         try:

{ata_coder-2.4.7 → ata_coder-2.4.8}/setup_wizard.py

@@ -111,7 +111,7 @@ def run_setup_wizard() -> None:
     print()
 
 
-__version__ = "2.4.7"
+__version__ = "2.4.8"
 
 
 def print_banner() -> None: