patch-chat 0.3.0__tar.gz → 0.5.0__tar.gz

{patch_chat-0.3.0 → patch_chat-0.5.0}/.claude/commands/upstream-issue.md

@@ -1,5 +1,5 @@
 ---
-description: Copy an upstream aider issue into this fork, fix it, ship it, and comment upstream
+description: Copy an upstream aider issue into this fork, fix it and ship it
 argument-hint: <upstream issue URL or number>
 allowed-tools: Bash(gh:*), Bash(git:*), Bash(python:*), Bash(pytest:*), Bash(pre-commit:*), Read, Edit, Write, Grep, Glob
 ---
@@ -33,17 +33,12 @@ If nothing here is worth changing, stop after step 3 and say why rather than clo
 ## 3. Copy it into the fork
 
 Create the issue in `PierrunoYT/patch`, preserving the upstream title unless it names something
-this fork calls differently, and the body verbatim. Append an attribution footer:
+this fork calls differently, and the body verbatim. Do not add source links, reporter attribution,
+or `@` mentions.
 
-```
----
-
-_Copied from [Aider-AI/aider#<N>](<url>) (opened by @<author> on <YYYY-MM-DD>)._
-```
-
-When your reading in step 2 differs from the reporter's — a different root cause, or the
-conclusion that the real defect is elsewhere — add a short paragraph after the footer saying so.
-That paragraph is your analysis, kept separate from their words.
+When your reading in step 2 differs from the report — a different root cause, or the conclusion
+that the real defect is elsewhere — add a short paragraph after the original body saying so. That
+paragraph is your analysis, kept separate from the copied words.
 
 Label it from the repo's existing labels (`gh label list --repo PierrunoYT/patch`): always the
 kind (`bug`, `documentation`, `enhancement`, `security`), always a severity (`critical`, `high`,
@@ -104,19 +99,18 @@ Push to `main`. That closes the fork issue. Confirm it did:
 gh issue list --repo PierrunoYT/patch --state closed --limit 3
 ```
 
-## 7. Comment upstream
+## 7. Nothing goes upstream
 
-Post it without asking — invoking this command is the authorisation. Write the comment to a file
-and post it with `gh issue comment <N> --repo Aider-AI/aider --body-file <file>`. It is a public
-comment on someone else's repository under the user's account, so write it as carefully as if you
-were going to be asked to defend it: say only what step 2 actually established, and nothing the
-tests do not cover.
+The pipeline ends at step 6. **This account is blocked from commenting on `Aider-AI/aider`**: on
+2026-08-31 a maintainer minimised twelve comments from it as `SPAM` and blocked it, so
+`gh issue comment` there returns `GraphQL: User is blocked (addComment)` and reactions are refused
+too. Reading still works, which is why steps 1–6 are unaffected.
 
-A good comment is short and factual: confirm or correct the diagnosis, show the actual fix, say
-what the tests cover, and disclose that Patch is a fork of aider. Offer a PR when the fix would
-apply upstream unchanged. No promotion.
+Do not post, do not write a comment for later, and do not look for another route to the same
+effect. A block is that project's decision, not an error to work around. Writing a reply that
+cannot be sent is wasted effort — if the block is ever lifted, or the user wants something to
+relay by hand, they will ask.
 
 ## Report back
 
-Finish with the fork issue number, the commit SHA, the test and hook results, and the upstream
-comment link.
+Finish with the fork issue number, the commit SHA, and the test and hook results.

patch_chat-0.5.0/.github/dependabot.yml

@@ -0,0 +1,30 @@
+version: 2
+
+# Nothing was watching the pins, which is how five months of advisories
+# accumulated in requirements.txt unnoticed. See issue #1472.
+#
+# requirements.txt and requirements/*.txt are generated by
+# ./scripts/pip-compile.sh from the matching .in files, so a Dependabot PR that
+# edits a .txt is a signal, not a patch to merge: raise the floor in the .in
+# file, re-run the script, and close the PR. AGENTS.md records the same rule.
+updates:
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    labels:
+      - security
+    groups:
+      # One PR per batch rather than ten: these are lockfiles, and they are
+      # regenerated as a set anyway.
+      python-dependencies:
+        patterns:
+          - "*"
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    labels:
+      - security

{patch_chat-0.3.0 → patch_chat-0.5.0}/AGENTS.md

@@ -85,7 +85,13 @@ Two root-level documents cover the audit history:
 - `patch/_version.py` — generated by setuptools_scm, gitignored.
 - `requirements/*.txt` — compiled from the matching `.in` files by
   `./scripts/pip-compile.sh`. Edit the `.in` file and re-run the script; never
-  hand-edit the `.txt`.
+  hand-edit the `.txt`. `requirements.txt` is also the distribution's install set
+  (`pyproject.toml` reads `dependencies` from it), so a pin here is what every
+  `pip install patch-chat` resolves to — a stale one ships to users, not just to
+  contributors. Security floors go in the `.in` file as `package>=fixed.version`,
+  next to a comment saying which advisory forced it. `.github/dependabot.yml`
+  watches these weekly; its PRs edit the generated `.txt` and are a signal to act
+  on, never a patch to merge.
 
 ## CI
 
@@ -132,10 +138,17 @@ code works — it is done when the docs match and the work is committed.
 Patch is a fork of [aider](https://github.com/Aider-AI/aider), and reports filed there often
 apply here. `.claude/commands/upstream-issue.md` is a Claude Code slash command
 (`/upstream-issue <url>`) that carries one from upstream to shipped: copy it into this repo's
-tracker with attribution, judge whether the defect is really ours — upstream `aider/foo.py` is
-`patch/foo.py` here, and a broken user environment has no fix in this code — write the fix and a
-regression test, update the docs above, commit with `Closes #N`, and only then comment upstream.
-Editing that file is how the procedure changes; do not keep a second copy of it here.
+tracker without source or reporter attribution, judge whether the defect is really ours — upstream
+`aider/foo.py` is `patch/foo.py` here, and a broken user environment has no fix in this code —
+write the fix and a regression test, update the docs above, and commit with `Closes #N`. Editing
+that file is how the procedure changes; do not keep a second copy of it here.
+
+The upstream half of that loop is closed. On 2026-08-31 an aider maintainer minimised twelve
+comments from this account as `SPAM` and blocked it from the repository: `gh issue comment` there
+returns `GraphQL: User is blocked (addComment)`, and reactions are refused too. Reading still
+works, so copying issues over and fixing them is unaffected — the command now ends at the commit,
+sends nothing upstream, and omits source and reporter references from copied issues. Do not try to
+post from elsewhere.
 
 ## Releases
 

{patch_chat-0.3.0 → patch_chat-0.5.0}/AUDIT_REPORT.md

@@ -3618,3 +3618,20 @@ test the safety of each policy decision, not only the presence of one.
 The 9.0 post-remediation score reflects all nine findings closed with focused tests and the full
 gate green. It remains below 10 because the fourth audit's structural constraints are unchanged:
 the type gate is intentionally partial and the largest modules still carry broad responsibilities.
+
+---
+
+## Post-audit upstream issue remediation
+
+These upstream reports were selected from the 2026-08-31 `aider-issues.json` snapshot after the
+fourth audit. They are not new audit findings and do not extend the F-1 – F-106 sequence. The
+snapshot has since been pruned of every report resolved in this fork, so the rows below are no
+longer found in it; its `removed_resolved` block lists the upstream numbers that were dropped.
+
+| Upstream report | Severity | Fork issue | Fix | Verification |
+| --- | --- | --- | --- | --- |
+| GitPython CVE-2026-42215, CVE-2026-42284, CVE-2026-44243 and CVE-2026-44244 | High | [#137](https://github.com/PierrunoYT/patch/issues/137) | **Resolved in `bf16ec6db`** by requiring GitPython 3.1.49+ | Dependency regression test, full `pytest`, and all pre-commit hooks |
+| Pillow CVE-2026-42311 | High | [#138](https://github.com/PierrunoYT/patch/issues/138) | **Resolved in `a7ef1ca21`** by requiring Pillow 12.2.0+ | Dependency regression test, full `pytest`, and all pre-commit hooks |
+| urllib3 CVE-2026-44431 | High | [#139](https://github.com/PierrunoYT/patch/issues/139) | **Resolved in `23358a200`** by requiring urllib3 2.7.0+ | Dependency regression test, full `pytest`, and all pre-commit hooks |
+| Fatal provider errors return success in one-shot mode | High | [#140](https://github.com/PierrunoYT/patch/issues/140) | **Resolved in `0af8c6508`** by propagating per-message provider failure to the CLI status | API-error retry-exhaustion test, one-shot status test, full `pytest`, and all pre-commit hooks |
+| Whole-file mode mishandles unified-diff output | Medium | [#141](https://github.com/PierrunoYT/patch/issues/141) | **Resolved in `083edb34f`** by detecting the format mismatch before edit parsing, with fence-span tracking added in `81cba83b0` and headerless diff fences covered in `a682516ef` | Bare, fenced and headerless diff regressions, a listing of a `.patch` file, full `pytest`, and all pre-commit hooks |

{patch_chat-0.3.0 → patch_chat-0.5.0}/CHANGELOG.md

@@ -7,6 +7,170 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.5.0] - 2026-09-01
+
+### Added
+
+- `--no-detect-file-mentions` stops Patch offering to add files the model names in its reply, for
+  sessions where the context should stay exactly what you added yourself. The prompt is otherwise
+  unchanged, and `--detect-file-mentions` is still the default.
+
+### Fixed
+
+- A reply that both edits files and asks for more files no longer loses the edits. Adding the
+  mentioned files returned before the edits were applied, so the edits in that reply were dropped
+  while the model was told its files had arrived -- it then carried on believing the edit had
+  landed, and its next edit failed to match a file that had never changed. The edits are applied
+  and committed first, and the request for more files is reflected back afterwards. An edit error
+  and a file request arriving together are now both reported, rather than only the file request.
+
+- A whole-file listing of a markdown file no longer stops at the first fenced block inside it.
+  Any ```` ``` ```` line ended the listing, so a file containing a code block was truncated there
+  and everything after it was written to a second file named after whichever line preceded the
+  next fence. A fence carrying a language ("```json") is now read as opening a block within the
+  listing, and the listing ends at the fence that closes it. A ```` ```diff ```` block inside a
+  listing is likewise content, not a mis-selected edit format. An inner block opened with a bare
+  ```` ``` ```` and no language remains ambiguous and still ends the listing.
+
+- A debug dump of the chat transcript no longer ends the session when the transcript holds text
+  the console cannot encode. Content reaches the transcript from files read with
+  `surrogateescape` and from model replies, so a lone surrogate can appear in it; printing one
+  raised an uncaught `UnicodeEncodeError` from inside `--verbose` output. Unprintable characters
+  are now replaced, and the dump is shown.
+
+- `/commit` now respects `--subtree-only`. It committed through `git commit -a`, which stages
+  every dirty file in the repository regardless of the subtree the session was scoped to, so
+  unrelated work elsewhere in the tree was swept into the commit without appearing anywhere the
+  user could see it. The commit is now restricted to dirty files inside the subtree, and does
+  nothing at all when the only changes are outside it.
+
+### Security
+
+- Web scraping no longer fetches private, loopback or link-local addresses. A URL that resolves
+  into one of those ranges is refused before the request is made, which closes the path from a
+  repository README naming `http://169.254.169.254/latest/meta-data/iam/security-credentials/` to
+  Patch fetching the cloud metadata service it happens to be running next to and putting IAM
+  credentials in the chat. The check runs after DNS resolution, so a hostname pointing at a private
+  address is refused too, and it runs again on every redirect hop, so a public URL cannot bounce
+  the scraper somewhere private. Under Playwright the same rule applies to what the page itself
+  loads, not only to the address in the URL bar. `--allow-private-urls` scrapes a local dev server
+  deliberately; a repository config cannot set it, since the repository is also what supplies the
+  URLs.
+
+- The browser UI now listens on `127.0.0.1` instead of every interface. `--browser` handed
+  Streamlit no address, and its default is to accept connections from anywhere, so running the UI
+  on a shared network put an unauthenticated page that can edit the repository and spend the user's
+  API credits in reach of everyone on it. `--gui-address ADDR` binds somewhere else on purpose and
+  warns when that address is not loopback; a repository config cannot set it.
+
+- litellm is now constrained to 1.84.0 or later, carrying the fixes for an authentication bypass
+  via Host header injection (CVE-2026-49468) along with CVE-2026-42208 and CVE-2026-35030. This is
+  the library every provider request passes through, so it is the code holding the user's API keys.
+  The pin is held below 1.85 deliberately: resolving the floor open-ended lands on 1.99, which adds
+  the AWS SDK to every install and downgrades `importlib-metadata`, and that is a change to make
+  and validate on its own terms rather than inside a security patch.
+
+- soupsieve is now constrained to 2.8.4 or later.
+
+- Dependency pins are now watched weekly by Dependabot, for both Python packages and GitHub
+  Actions. Nothing had been watching them, which is how a lockfile that is also the published
+  install set accumulated advisories unnoticed. `CONTRIBUTING.md` and `AGENTS.md` describe how to
+  act on what it reports, since the files it edits are generated.
+
+## [0.4.0] - 2026-09-01
+
+### Changed
+
+- The `/upstream-issue` command no longer sends anything to aider or adds source and reporter
+  references to copied issues. This account was blocked from commenting on that repository on
+  2026-08-31, after twelve comments in an afternoon were minimised as spam, so the command now
+  keeps the workflow entirely inside this fork and ends at the commit. Reading upstream reports,
+  copying applicable defects, and fixing them remain unaffected.
+
+- `/report` now prefills the questions a report has to answer -- what happened, what was expected
+  instead, and how to reproduce it -- above the session details. The command previously sent only
+  the announcements, which describe how the session was configured and nothing about the problem,
+  so the prefilled form was routinely submitted as an issue that said nothing at all. Text passed
+  to the command now answers the first question as well as titling the issue, where before it was
+  the title alone. `CONTRIBUTING.md` describes what to fill in.
+
+### Removed
+
+- The stale generated dump of upstream aider issues is no longer stored in the repository.
+
+### Fixed
+
+- Git repositories now use GitPython's default command-backed object database instead of forcing
+  `GitDB`, which could report `BadObject` for objects that Git itself reads successfully and prevent
+  Patch from opening a valid repository.
+
+- The Polyglot benchmark now gives models the files listed by Exercism under `files.editor` as
+  read-only context. Solution files remain editable, while tests and example implementations remain
+  hidden, so pass@1 no longer depends on guessing interfaces supplied by the exercise.
+
+- Cached input tokens are no longer charged twice in Patch's displayed cost. Cache writes and reads
+  use provider metadata when available, only the uncached remainder uses the ordinary input rate,
+  and inconsistent provider counts can no longer produce a negative uncached charge.
+
+- `/tokens` now measures editable and read-only text files with a real closing code fence instead of
+  counting the literal text `{fence}`.
+
+- Unified-diff parsing now strips standard Git `a/` and `b/` prefixes from every file in a fenced
+  multi-file diff, rather than only from the first file.
+
+- Whole-file mode now reports and reflects recognizable unified-diff output instead of silently
+  discarding a bare diff or misreading a fenced diff as a new whole-file listing. Recognition
+  follows active listing fences, so an earlier completed example block cannot hide a later diff
+  and be applied as an edit. A `diff`- or `patch`-tagged fence counts on its own, without the
+  `---` and `+++` headers a short hunk often omits: such a block was being read as a listing and
+  written to a file named after the sentence above it, so a reply opening "Here is the change:"
+  left a file called `Here is the change` in the repository. The line above a fence still names a
+  file when it looks like one, which is how a listing of a `.diff` or `.patch` file is written.
+  This can happen when an unlisted model ignores the automatically selected edit format; the model
+  now gets a precise instruction to retry with the entire updated file.
+
+- A fatal model-provider error in `--message` and `--message-file` mode now returns a nonzero exit
+  status after retries are exhausted. Headless callers previously received status 0 even though no
+  response was produced, making a failed API request indistinguishable from a successful no-op.
+
+- A commit-message model that answers with nothing but whitespace no longer stops the fallback.
+  The reply was judged before being trimmed, and a string of spaces is not empty as far as an
+  `if` is concerned -- so the first model ended the search without producing anything, and the
+  next one configured was never asked. The same untrimmed test guarded the "Failed to generate
+  commit message!" report, which therefore did not appear either: the commit was made as "(no
+  commit message provided)" with nothing said at the time. Each reply is now trimmed as it
+  arrives, so the fallback and the failure report both see what the model actually sent.
+
+- Search/replace blocks whose fences are indented no longer lose their filename. The search back
+  through the preceding lines tested the raw line for a fence while the filename check stripped
+  the line first, so the two disagreed about what a fence was and the search stopped one line
+  short: a model that indented "```python" produced a valid edit that was rejected for naming no
+  file. The docstring's own indented example now parses.
+
+- A `.gitignore` containing non-ASCII characters no longer crashes `--watch-files` at startup. The
+  file was decoded with the system's locale encoding rather than the UTF-8 Git itself uses, so on
+  Windows a single accented path in the ignore file ended the session with an uncaught
+  `UnicodeDecodeError` before the first prompt. Bytes that are not valid UTF-8 are now replaced,
+  and the remaining patterns still apply.
+
+- The "what's new in this version" offer shown on the first run after an upgrade now opens that
+  version's release page rather than `CHANGELOG.md` on `main`. The link was always the newest file,
+  so it showed entries still sitting under `Unreleased`, and once a later version was cut it buried
+  the section it was meant to show under the newer one. `--show-release-notes` follows the same
+  link. A development build has no tag behind it and so still opens the changelog.
+
+### Security
+
+- urllib3 is now constrained to 2.7.0 or later, preventing low-level proxied cross-origin redirects
+  from forwarding sensitive authorization and cookie headers under CVE-2026-44431.
+
+- Pillow is now constrained to 12.2.0 or later so a malicious PSD cannot trigger the memory
+  corruption and potential arbitrary code execution identified as CVE-2026-42311.
+
+- GitPython is now constrained to 3.1.49 or later, closing four High-severity vulnerabilities in
+  the previous 3.1.46 lock: configuration injection that could select an attacker-controlled Git
+  hooks directory, unsafe clone options, and incomplete hardening of those paths.
+
 ## [0.3.0] - 2026-08-31
 
 ### Added
@@ -910,7 +1074,9 @@ than continuing the upstream `0.86.x` numbering.
   `.env`, including `OPENAI_API_KEY` and `PATCH_MODEL`, still load normally; and anything passed on
   the command line always wins.
 
-[Unreleased]: https://github.com/PierrunoYT/patch/compare/v0.3.0...main
+[Unreleased]: https://github.com/PierrunoYT/patch/compare/v0.5.0...main
+[0.5.0]: https://github.com/PierrunoYT/patch/compare/v0.4.0...v0.5.0
+[0.4.0]: https://github.com/PierrunoYT/patch/compare/v0.3.0...v0.4.0
 [0.3.0]: https://github.com/PierrunoYT/patch/compare/v0.2.0...v0.3.0
 [0.2.0]: https://github.com/PierrunoYT/patch/compare/v0.1.0...v0.2.0
 [0.1.0]: https://github.com/PierrunoYT/patch/releases/tag/v0.1.0

{patch_chat-0.3.0 → patch_chat-0.5.0}/CONTRIBUTING.md

@@ -11,6 +11,12 @@ Please submit bug reports and feature requests as GitHub issues. This
 helps us to keep track of them and discuss potential solutions or
 enhancements.
 
+From inside a session, `/report` opens a prefilled issue form in your browser:
+the version and model settings of that session, plus headings for what
+happened, what you expected instead, and how to reproduce it. Please answer
+those three — the settings say how Patch was configured, never what went
+wrong. `/report <summary>` titles the issue and answers the first one.
+
 ## LLM Benchmark Results
 
 Contributions of
@@ -274,6 +280,16 @@ Any arguments you pass to `pip-compile.sh` flow through to `uv pip compile`. For
 Note that a plain re-run keeps the existing pins: `uv` treats the current lock as a preference, so
 moving a dependency needs one of the `--upgrade` flags above.
 
+**Security updates.** `requirements.txt` is the distribution's install set — `pyproject.toml` reads
+`dependencies` from it — so a vulnerable pin is what everyone who runs `pip install patch-chat`
+receives. Raise the floor in the `.in` file (`package>=fixed.version`) with a comment naming the
+advisory, then re-run the script. Prefer the narrowest range that carries the fix: resolving an
+open-ended floor can jump many minor versions at once and bring new transitive dependencies with
+it, which is a change to review on its own terms rather than inside a security patch.
+`.github/dependabot.yml` watches the pins weekly, and its pull requests edit the generated `.txt`
+files — treat them as notification that a floor needs raising, and close them in favour of a
+regenerated lock.
+
 ### Pre-commit Hooks
 
 The project uses [pre-commit](https://pre-commit.com/) hooks to automatically format code, lint, and run other checks before committing changes. After cloning the repository, run the following command to set up the pre-commit hooks:

patch_chat-0.5.0/MANIFEST.in

@@ -0,0 +1,6 @@
+global-exclude .DS_Store
+
+# Working data, not part of the distribution. setuptools-scm's git file finder
+# puts every tracked root file into the sdist, so without this the 2.7 MB
+# snapshot of aider's issue tracker would ship inside patch-chat.
+exclude aider-issues.json

{patch_chat-0.3.0/patch_chat.egg-info → patch_chat-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: patch-chat
-Version: 0.3.0
+Version: 0.5.0
 Summary: Patch is AI pair programming in your terminal
 License-Expression: Apache-2.0
 Project-URL: Homepage, https://github.com/PierrunoYT/patch
@@ -19,7 +19,7 @@ Requires-Python: <3.15,>=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE.txt
 Requires-Dist: aiohappyeyeballs==2.6.1
-Requires-Dist: aiohttp==3.13.3
+Requires-Dist: aiohttp==3.14.3
 Requires-Dist: aiosignal==1.4.0
 Requires-Dist: annotated-doc==0.0.4
 Requires-Dist: annotated-types==0.7.0
@@ -45,7 +45,7 @@ Requires-Dist: filelock==3.25.2
 Requires-Dist: frozenlist==1.8.0
 Requires-Dist: fsspec==2026.2.0
 Requires-Dist: gitdb==4.0.12
-Requires-Dist: gitpython==3.1.46
+Requires-Dist: gitpython==3.1.61
 Requires-Dist: grep-ast==0.9.0
 Requires-Dist: h11==0.16.0
 Requires-Dist: hf-xet==1.4.2; platform_machine == "AMD64" or platform_machine == "aarch64" or platform_machine == "amd64" or platform_machine == "arm64" or platform_machine == "x86_64"
@@ -53,14 +53,14 @@ Requires-Dist: httpcore==1.0.9
 Requires-Dist: httpx==0.28.1
 Requires-Dist: huggingface-hub==1.7.1
 Requires-Dist: idna==3.11
-Requires-Dist: importlib-metadata==9.0.1
+Requires-Dist: importlib-metadata==8.9.0
 Requires-Dist: importlib-resources==6.5.2
 Requires-Dist: jinja2==3.1.6
 Requires-Dist: jiter==0.13.0
 Requires-Dist: json5==0.13.0
 Requires-Dist: jsonschema==4.26.0
 Requires-Dist: jsonschema-specifications==2025.9.1
-Requires-Dist: litellm==1.82.3
+Requires-Dist: litellm==1.84.10
 Requires-Dist: markdown-it-py==4.0.0
 Requires-Dist: markupsafe==3.0.3
 Requires-Dist: mdurl==0.1.2
@@ -74,7 +74,7 @@ Requires-Dist: oslex==0.1.3
 Requires-Dist: packaging==26.0
 Requires-Dist: pathspec==1.0.4
 Requires-Dist: pexpect==4.9.0
-Requires-Dist: pillow==12.1.1
+Requires-Dist: pillow==12.3.0
 Requires-Dist: posthog==7.9.12
 Requires-Dist: prompt-toolkit==3.0.52
 Requires-Dist: propcache==0.4.1
@@ -104,7 +104,7 @@ Requires-Dist: smmap==5.0.3
 Requires-Dist: sniffio==1.3.1
 Requires-Dist: sounddevice==0.5.5
 Requires-Dist: soundfile==0.13.1
-Requires-Dist: soupsieve==2.8.3
+Requires-Dist: soupsieve==2.9.2
 Requires-Dist: tiktoken==0.12.0
 Requires-Dist: tokenizers==0.22.2
 Requires-Dist: tqdm==4.67.3
@@ -116,7 +116,7 @@ Requires-Dist: tree-sitter-yaml==0.7.2
 Requires-Dist: typer==0.24.1
 Requires-Dist: typing-extensions==4.15.0
 Requires-Dist: typing-inspection==0.4.2
-Requires-Dist: urllib3==2.6.3
+Requires-Dist: urllib3==2.7.0
 Requires-Dist: watchfiles==1.1.1
 Requires-Dist: wcwidth==0.6.0
 Requires-Dist: yarl==1.23.0
@@ -170,7 +170,7 @@ Requires-Dist: numpy==2.4.3; python_full_version >= "3.11" and extra == "dev"
 Requires-Dist: packaging==26.0; extra == "dev"
 Requires-Dist: pandas==2.3.3; extra == "dev"
 Requires-Dist: pathspec==1.0.4; extra == "dev"
-Requires-Dist: pillow==12.1.1; extra == "dev"
+Requires-Dist: pillow==12.3.0; extra == "dev"
 Requires-Dist: platformdirs==4.9.4; extra == "dev"
 Requires-Dist: pluggy==1.6.0; extra == "dev"
 Requires-Dist: pre-commit==4.5.1; extra == "dev"
@@ -200,7 +200,7 @@ Requires-Dist: tomli==2.4.1; python_full_version <= "3.11" and extra == "dev"
 Requires-Dist: typer==0.24.1; extra == "dev"
 Requires-Dist: typing-extensions==4.15.0; extra == "dev"
 Requires-Dist: tzdata==2025.3; extra == "dev"
-Requires-Dist: urllib3==2.6.3; extra == "dev"
+Requires-Dist: urllib3==2.7.0; extra == "dev"
 Requires-Dist: uv==0.10.11; extra == "dev"
 Requires-Dist: virtualenv==21.2.0; extra == "dev"
 Provides-Extra: browser
@@ -213,7 +213,7 @@ Requires-Dist: charset-normalizer==3.4.6; extra == "browser"
 Requires-Dist: click==8.3.1; extra == "browser"
 Requires-Dist: colorama==0.4.6; sys_platform == "win32" and extra == "browser"
 Requires-Dist: gitdb==4.0.12; extra == "browser"
-Requires-Dist: gitpython==3.1.46; extra == "browser"
+Requires-Dist: gitpython==3.1.61; extra == "browser"
 Requires-Dist: idna==3.11; extra == "browser"
 Requires-Dist: jinja2==3.1.6; extra == "browser"
 Requires-Dist: jsonschema==4.26.0; extra == "browser"
@@ -224,7 +224,7 @@ Requires-Dist: numpy==1.26.4; python_full_version < "3.11" and extra == "browser
 Requires-Dist: numpy==2.4.3; python_full_version >= "3.11" and extra == "browser"
 Requires-Dist: packaging==26.0; extra == "browser"
 Requires-Dist: pandas==2.3.3; extra == "browser"
-Requires-Dist: pillow==12.1.1; extra == "browser"
+Requires-Dist: pillow==12.3.0; extra == "browser"
 Requires-Dist: protobuf==6.33.5; extra == "browser"
 Requires-Dist: pyarrow==23.0.1; extra == "browser"
 Requires-Dist: pydeck==0.9.1; extra == "browser"
@@ -241,7 +241,7 @@ Requires-Dist: toml==0.10.2; extra == "browser"
 Requires-Dist: tornado==6.5.5; extra == "browser"
 Requires-Dist: typing-extensions==4.15.0; extra == "browser"
 Requires-Dist: tzdata==2025.3; extra == "browser"
-Requires-Dist: urllib3==2.6.3; extra == "browser"
+Requires-Dist: urllib3==2.7.0; extra == "browser"
 Requires-Dist: watchdog==6.0.0; sys_platform != "darwin" and extra == "browser"
 Provides-Extra: playwright
 Requires-Dist: greenlet==3.3.2; extra == "playwright"
@@ -346,7 +346,8 @@ refused whether it sits inside the repository or outside it.
 
 **The repository's own config is not trusted.** A `.patch.conf.yml` or `.env` discovered inside
 the repository cannot set execution-capable options (`test`, `test-cmd`, `lint-cmd`, `load`,
-`notifications-command`, `editor`, `verify-ssl`, `git-commit-verify`) or environment variables
+`notifications-command`, `editor`, `verify-ssl`, `git-commit-verify`, `allow-private-urls`,
+`gui-address`) or environment variables
 that redirect API endpoints or proxies (`*_API_BASE`, `*_BASE_URL`, `HTTP(S)_PROXY`,
 `REQUESTS_CA_BUNDLE`, ...). Nor can it name another file for Patch to trust — `env-file`,
 `model-settings-file` and `model-metadata-file` are refused from repository config for that reason.
@@ -364,6 +365,19 @@ Pass `--trust-repo-config` to opt back in for a repository you trust. You can al
 `PATCH_TRUST_REPO_CONFIG` in your shell. The setting is ignored when it comes from the repository's
 own config or `.env`, so a repository cannot grant itself trust.
 
+**Scraping stays on public addresses.** `/web`, and any URL Patch fetches on your behalf, is
+refused when it resolves to a private, loopback or link-local address. Cloud metadata services
+answer on `169.254.169.254` and hand out IAM credentials to whatever asks, and the URL usually
+comes from the repository — a README is enough to aim it. Names are checked after resolution, so a
+hostname with an A record pointing at a private address is refused too, as is a redirect that
+arrives at one. Pass `--allow-private-urls` to scrape a local dev server deliberately; a repository
+config cannot set it.
+
+**The browser UI listens on this machine only.** `--browser` / `--gui` binds `127.0.0.1`. The UI
+has no authentication and can edit your repository and spend your API credits, so it is not
+something to put on a shared network by accident. `--gui-address ADDR` moves it deliberately —
+`--gui-address 0.0.0.0` accepts connections from anywhere and says so at startup.
+
 **Running in a container.** The boundary above distinguishes your files from the repository's by
 comparing against your home directory, so do not set `HOME` to the directory you mount the project
 into — the two become indistinguishable and every filter above stops applying. The bundled

{patch_chat-0.3.0 → patch_chat-0.5.0}/README.md

@@ -94,7 +94,8 @@ refused whether it sits inside the repository or outside it.
 
 **The repository's own config is not trusted.** A `.patch.conf.yml` or `.env` discovered inside
 the repository cannot set execution-capable options (`test`, `test-cmd`, `lint-cmd`, `load`,
-`notifications-command`, `editor`, `verify-ssl`, `git-commit-verify`) or environment variables
+`notifications-command`, `editor`, `verify-ssl`, `git-commit-verify`, `allow-private-urls`,
+`gui-address`) or environment variables
 that redirect API endpoints or proxies (`*_API_BASE`, `*_BASE_URL`, `HTTP(S)_PROXY`,
 `REQUESTS_CA_BUNDLE`, ...). Nor can it name another file for Patch to trust — `env-file`,
 `model-settings-file` and `model-metadata-file` are refused from repository config for that reason.
@@ -112,6 +113,19 @@ Pass `--trust-repo-config` to opt back in for a repository you trust. You can al
 `PATCH_TRUST_REPO_CONFIG` in your shell. The setting is ignored when it comes from the repository's
 own config or `.env`, so a repository cannot grant itself trust.
 
+**Scraping stays on public addresses.** `/web`, and any URL Patch fetches on your behalf, is
+refused when it resolves to a private, loopback or link-local address. Cloud metadata services
+answer on `169.254.169.254` and hand out IAM credentials to whatever asks, and the URL usually
+comes from the repository — a README is enough to aim it. Names are checked after resolution, so a
+hostname with an A record pointing at a private address is refused too, as is a redirect that
+arrives at one. Pass `--allow-private-urls` to scrape a local dev server deliberately; a repository
+config cannot set it.
+
+**The browser UI listens on this machine only.** `--browser` / `--gui` binds `127.0.0.1`. The UI
+has no authentication and can edit your repository and spend your API credits, so it is not
+something to put on a shared network by accident. `--gui-address ADDR` moves it deliberately —
+`--gui-address 0.0.0.0` accepts connections from anywhere and says so at startup.
+
 **Running in a container.** The boundary above distinguishes your files from the repository's by
 comparing against your home directory, so do not set `HOME` to the directory you mount the project
 into — the two become indistinguishable and every filter above stops applying. The bundled

{patch_chat-0.3.0 → patch_chat-0.5.0}/benchmark/benchmark.py

@@ -727,6 +727,7 @@ def run_test_real(
     test_files = config.get("files", {}).get("test", [])
     example_files = config.get("files", {}).get("example", [])
     solution_files = set(config.get("files", {}).get("solution", []))
+    editor_files = set(config.get("files", {}).get("editor", []))
 
     # Forcibly ignore certain files not covered by test_files and example_files
     ignore_files = set(
@@ -747,6 +748,12 @@ def run_test_real(
     # Remove any ignore files from the solution set that LLM will edit
     solution_files.difference_update(ignore_files)
 
+    # Editor files provide context, but tests and examples must remain hidden.
+    editor_files.difference_update(test_files)
+    editor_files.difference_update(example_files)
+    editor_files.difference_update(solution_files)
+    read_only_fnames = [testdir / file_path for file_path in sorted(editor_files)]
+
     # Copy all solution files
     for file_path in solution_files:
         src = testdir / Path(file_path)
@@ -824,6 +831,7 @@ def run_test_real(
         edit_format,
         io,
         fnames=fnames,
+        read_only_fnames=read_only_fnames,
         use_git=False,
         stream=False,
         verbose=verbose,