auto-code-fixer 0.3.1__tar.gz → 0.3.3__tar.gz

{auto_code_fixer-0.3.1 → auto_code_fixer-0.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: auto-code-fixer
-Version: 0.3.1
+Version: 0.3.3
 Summary: Automatically fix Python code using ChatGPT
 Author-email: Arif Shah <ashah7775@gmail.com>
 License: MIT

auto_code_fixer-0.3.3/auto_code_fixer/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.3.3"

{auto_code_fixer-0.3.1 → auto_code_fixer-0.3.3}/auto_code_fixer/cli.py

@@ -88,15 +88,43 @@ def fix_file(file_path, project_root, api_key, ask, verbose, *, dry_run: bool, m
                 if dry_run:
                     log("DRY RUN: would apply fixes:\n" + "\n".join(rel_changes), "WARN")
                 else:
+                    sr = os.path.realpath(os.path.abspath(sandbox_root))
+                    pr = os.path.realpath(os.path.abspath(project_root))
+
                     for p in sorted(changed_sandbox_files):
-                        rel = os.path.relpath(p, sandbox_root)
-                        dst = os.path.join(project_root, rel)
-                        if os.path.exists(dst):
-                            bak = backup_file(dst)
+                        p_real = os.path.realpath(os.path.abspath(p))
+
+                        # compute rel using real paths to avoid macOS /private path weirdness
+                        rel = os.path.relpath(p_real, sr)
+
+                        # Safety: never allow paths escaping the sandbox
+                        if rel.startswith(".." + os.sep) or rel == "..":
+                            log(f"Skipping suspicious path outside sandbox: {p}", "WARN")
+                            continue
+
+                        dst = os.path.join(pr, rel)
+                        dst_real = os.path.realpath(os.path.abspath(dst))
+
+                        # Safety: never write outside the project root
+                        if not (dst_real.startswith(pr + os.sep) or dst_real == pr):
+                            log(f"Skipping suspicious destination outside project: {dst}", "WARN")
+                            continue
+
+                        # Avoid shutil.SameFileError
+                        try:
+                            if os.path.exists(dst_real) and os.path.samefile(p_real, dst_real):
+                                log(f"Skip copy (same file): {dst_real}", "DEBUG")
+                                continue
+                        except Exception:
+                            pass
+
+                        if os.path.exists(dst_real):
+                            bak = backup_file(dst_real)
                             log(f"Backup created: {bak}", "DEBUG")
-                        os.makedirs(os.path.dirname(dst), exist_ok=True)
-                        shutil.copy(p, dst)
-                        log(f"File updated: {dst}")
+
+                        os.makedirs(os.path.dirname(dst_real), exist_ok=True)
+                        shutil.copy(p_real, dst_real)
+                        log(f"File updated: {dst_real}")
 
             shutil.rmtree(sandbox_root)
             log(f"Fix completed in {attempt + 1} attempt(s) 🎉")
@@ -115,6 +143,15 @@ def fix_file(file_path, project_root, api_key, ask, verbose, *, dry_run: bool, m
 
         target_file = pick_relevant_file(stderr, sandbox_root=sandbox_root) or sandbox_entry
 
+        # Safety: ensure target_file is within sandbox
+        try:
+            sr = os.path.realpath(os.path.abspath(sandbox_root))
+            tf = os.path.realpath(os.path.abspath(target_file))
+            if not (tf.startswith(sr + os.sep) or tf == sr):
+                target_file = sandbox_entry
+        except Exception:
+            target_file = sandbox_entry
+
         # Optional AI fix plan can override file selection
         try:
             from auto_code_fixer.plan import ask_ai_for_fix_plan

{auto_code_fixer-0.3.1 → auto_code_fixer-0.3.3}/auto_code_fixer/traceback_utils.py

@@ -4,24 +4,34 @@ import re
 _FILE_RE = re.compile(r"File \"([^\"]+)\", line (\d+)")
 
 
+def _norm(p: str) -> str:
+    """Normalize paths for comparison.
+
+    On macOS tracebacks often include /private prefix; realpath handles that.
+    """
+    return os.path.realpath(os.path.abspath(p))
+
+
 def pick_relevant_file(stderr: str, *, sandbox_root: str) -> str | None:
     """Pick the most relevant python file from a traceback.
 
     Strategy: return the last file path that lives inside sandbox_root.
+
+    Uses realpath() to handle macOS '/private/var/...' vs '/var/...' differences.
     """
 
     if not stderr:
         return None
 
-    sandbox_root = os.path.abspath(sandbox_root)
+    sandbox_root_n = _norm(sandbox_root)
     matches = _FILE_RE.findall(stderr)
     if not matches:
         return None
 
     chosen = None
     for path, _lineno in matches:
-        ap = os.path.abspath(path)
-        if ap.startswith(sandbox_root):
+        ap = _norm(path)
+        if ap.startswith(sandbox_root_n + os.sep) or ap == sandbox_root_n:
             chosen = ap
 
     return chosen

{auto_code_fixer-0.3.1 → auto_code_fixer-0.3.3}/auto_code_fixer.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: auto-code-fixer
-Version: 0.3.1
+Version: 0.3.3
 Summary: Automatically fix Python code using ChatGPT
 Author-email: Arif Shah <ashah7775@gmail.com>
 License: MIT

{auto_code_fixer-0.3.1 → auto_code_fixer-0.3.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "auto-code-fixer"
-version = "0.3.1"
+version = "0.3.3"
 description = "Automatically fix Python code using ChatGPT"
 readme = "README.md"
 

auto_code_fixer-0.3.1/auto_code_fixer/__init__.py

@@ -1 +0,0 @@
-__version__ = "0.3.1"