patch-chat 0.4.0__tar.gz → 0.5.0__tar.gz

patch_chat-0.5.0/.github/dependabot.yml

@@ -0,0 +1,30 @@
+version: 2
+
+# Nothing was watching the pins, which is how five months of advisories
+# accumulated in requirements.txt unnoticed. See issue #1472.
+#
+# requirements.txt and requirements/*.txt are generated by
+# ./scripts/pip-compile.sh from the matching .in files, so a Dependabot PR that
+# edits a .txt is a signal, not a patch to merge: raise the floor in the .in
+# file, re-run the script, and close the PR. AGENTS.md records the same rule.
+updates:
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    labels:
+      - security
+    groups:
+      # One PR per batch rather than ten: these are lockfiles, and they are
+      # regenerated as a set anyway.
+      python-dependencies:
+        patterns:
+          - "*"
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    labels:
+      - security

{patch_chat-0.4.0 → patch_chat-0.5.0}/AGENTS.md

@@ -85,7 +85,13 @@ Two root-level documents cover the audit history:
 - `patch/_version.py` — generated by setuptools_scm, gitignored.
 - `requirements/*.txt` — compiled from the matching `.in` files by
   `./scripts/pip-compile.sh`. Edit the `.in` file and re-run the script; never
-  hand-edit the `.txt`.
+  hand-edit the `.txt`. `requirements.txt` is also the distribution's install set
+  (`pyproject.toml` reads `dependencies` from it), so a pin here is what every
+  `pip install patch-chat` resolves to — a stale one ships to users, not just to
+  contributors. Security floors go in the `.in` file as `package>=fixed.version`,
+  next to a comment saying which advisory forced it. `.github/dependabot.yml`
+  watches these weekly; its PRs edit the generated `.txt` and are a signal to act
+  on, never a patch to merge.
 
 ## CI
 

{patch_chat-0.4.0 → patch_chat-0.5.0}/CHANGELOG.md

@@ -7,6 +7,76 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.5.0] - 2026-09-01
+
+### Added
+
+- `--no-detect-file-mentions` stops Patch offering to add files the model names in its reply, for
+  sessions where the context should stay exactly what you added yourself. The prompt is otherwise
+  unchanged, and `--detect-file-mentions` is still the default.
+
+### Fixed
+
+- A reply that both edits files and asks for more files no longer loses the edits. Adding the
+  mentioned files returned before the edits were applied, so the edits in that reply were dropped
+  while the model was told its files had arrived -- it then carried on believing the edit had
+  landed, and its next edit failed to match a file that had never changed. The edits are applied
+  and committed first, and the request for more files is reflected back afterwards. An edit error
+  and a file request arriving together are now both reported, rather than only the file request.
+
+- A whole-file listing of a markdown file no longer stops at the first fenced block inside it.
+  Any ```` ``` ```` line ended the listing, so a file containing a code block was truncated there
+  and everything after it was written to a second file named after whichever line preceded the
+  next fence. A fence carrying a language ("```json") is now read as opening a block within the
+  listing, and the listing ends at the fence that closes it. A ```` ```diff ```` block inside a
+  listing is likewise content, not a mis-selected edit format. An inner block opened with a bare
+  ```` ``` ```` and no language remains ambiguous and still ends the listing.
+
+- A debug dump of the chat transcript no longer ends the session when the transcript holds text
+  the console cannot encode. Content reaches the transcript from files read with
+  `surrogateescape` and from model replies, so a lone surrogate can appear in it; printing one
+  raised an uncaught `UnicodeEncodeError` from inside `--verbose` output. Unprintable characters
+  are now replaced, and the dump is shown.
+
+- `/commit` now respects `--subtree-only`. It committed through `git commit -a`, which stages
+  every dirty file in the repository regardless of the subtree the session was scoped to, so
+  unrelated work elsewhere in the tree was swept into the commit without appearing anywhere the
+  user could see it. The commit is now restricted to dirty files inside the subtree, and does
+  nothing at all when the only changes are outside it.
+
+### Security
+
+- Web scraping no longer fetches private, loopback or link-local addresses. A URL that resolves
+  into one of those ranges is refused before the request is made, which closes the path from a
+  repository README naming `http://169.254.169.254/latest/meta-data/iam/security-credentials/` to
+  Patch fetching the cloud metadata service it happens to be running next to and putting IAM
+  credentials in the chat. The check runs after DNS resolution, so a hostname pointing at a private
+  address is refused too, and it runs again on every redirect hop, so a public URL cannot bounce
+  the scraper somewhere private. Under Playwright the same rule applies to what the page itself
+  loads, not only to the address in the URL bar. `--allow-private-urls` scrapes a local dev server
+  deliberately; a repository config cannot set it, since the repository is also what supplies the
+  URLs.
+
+- The browser UI now listens on `127.0.0.1` instead of every interface. `--browser` handed
+  Streamlit no address, and its default is to accept connections from anywhere, so running the UI
+  on a shared network put an unauthenticated page that can edit the repository and spend the user's
+  API credits in reach of everyone on it. `--gui-address ADDR` binds somewhere else on purpose and
+  warns when that address is not loopback; a repository config cannot set it.
+
+- litellm is now constrained to 1.84.0 or later, carrying the fixes for an authentication bypass
+  via Host header injection (CVE-2026-49468) along with CVE-2026-42208 and CVE-2026-35030. This is
+  the library every provider request passes through, so it is the code holding the user's API keys.
+  The pin is held below 1.85 deliberately: resolving the floor open-ended lands on 1.99, which adds
+  the AWS SDK to every install and downgrades `importlib-metadata`, and that is a change to make
+  and validate on its own terms rather than inside a security patch.
+
+- soupsieve is now constrained to 2.8.4 or later.
+
+- Dependency pins are now watched weekly by Dependabot, for both Python packages and GitHub
+  Actions. Nothing had been watching them, which is how a lockfile that is also the published
+  install set accumulated advisories unnoticed. `CONTRIBUTING.md` and `AGENTS.md` describe how to
+  act on what it reports, since the files it edits are generated.
+
 ## [0.4.0] - 2026-09-01
 
 ### Changed
@@ -1004,7 +1074,8 @@ than continuing the upstream `0.86.x` numbering.
   `.env`, including `OPENAI_API_KEY` and `PATCH_MODEL`, still load normally; and anything passed on
   the command line always wins.
 
-[Unreleased]: https://github.com/PierrunoYT/patch/compare/v0.4.0...main
+[Unreleased]: https://github.com/PierrunoYT/patch/compare/v0.5.0...main
+[0.5.0]: https://github.com/PierrunoYT/patch/compare/v0.4.0...v0.5.0
 [0.4.0]: https://github.com/PierrunoYT/patch/compare/v0.3.0...v0.4.0
 [0.3.0]: https://github.com/PierrunoYT/patch/compare/v0.2.0...v0.3.0
 [0.2.0]: https://github.com/PierrunoYT/patch/compare/v0.1.0...v0.2.0

{patch_chat-0.4.0 → patch_chat-0.5.0}/CONTRIBUTING.md

@@ -280,6 +280,16 @@ Any arguments you pass to `pip-compile.sh` flow through to `uv pip compile`. For
 Note that a plain re-run keeps the existing pins: `uv` treats the current lock as a preference, so
 moving a dependency needs one of the `--upgrade` flags above.
 
+**Security updates.** `requirements.txt` is the distribution's install set — `pyproject.toml` reads
+`dependencies` from it — so a vulnerable pin is what everyone who runs `pip install patch-chat`
+receives. Raise the floor in the `.in` file (`package>=fixed.version`) with a comment naming the
+advisory, then re-run the script. Prefer the narrowest range that carries the fix: resolving an
+open-ended floor can jump many minor versions at once and bring new transitive dependencies with
+it, which is a change to review on its own terms rather than inside a security patch.
+`.github/dependabot.yml` watches the pins weekly, and its pull requests edit the generated `.txt`
+files — treat them as notification that a floor needs raising, and close them in favour of a
+regenerated lock.
+
 ### Pre-commit Hooks
 
 The project uses [pre-commit](https://pre-commit.com/) hooks to automatically format code, lint, and run other checks before committing changes. After cloning the repository, run the following command to set up the pre-commit hooks:

{patch_chat-0.4.0/patch_chat.egg-info → patch_chat-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: patch-chat
-Version: 0.4.0
+Version: 0.5.0
 Summary: Patch is AI pair programming in your terminal
 License-Expression: Apache-2.0
 Project-URL: Homepage, https://github.com/PierrunoYT/patch
@@ -19,7 +19,7 @@ Requires-Python: <3.15,>=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE.txt
 Requires-Dist: aiohappyeyeballs==2.6.1
-Requires-Dist: aiohttp==3.13.3
+Requires-Dist: aiohttp==3.14.3
 Requires-Dist: aiosignal==1.4.0
 Requires-Dist: annotated-doc==0.0.4
 Requires-Dist: annotated-types==0.7.0
@@ -53,14 +53,14 @@ Requires-Dist: httpcore==1.0.9
 Requires-Dist: httpx==0.28.1
 Requires-Dist: huggingface-hub==1.7.1
 Requires-Dist: idna==3.11
-Requires-Dist: importlib-metadata==9.0.1
+Requires-Dist: importlib-metadata==8.9.0
 Requires-Dist: importlib-resources==6.5.2
 Requires-Dist: jinja2==3.1.6
 Requires-Dist: jiter==0.13.0
 Requires-Dist: json5==0.13.0
 Requires-Dist: jsonschema==4.26.0
 Requires-Dist: jsonschema-specifications==2025.9.1
-Requires-Dist: litellm==1.82.3
+Requires-Dist: litellm==1.84.10
 Requires-Dist: markdown-it-py==4.0.0
 Requires-Dist: markupsafe==3.0.3
 Requires-Dist: mdurl==0.1.2
@@ -104,7 +104,7 @@ Requires-Dist: smmap==5.0.3
 Requires-Dist: sniffio==1.3.1
 Requires-Dist: sounddevice==0.5.5
 Requires-Dist: soundfile==0.13.1
-Requires-Dist: soupsieve==2.8.3
+Requires-Dist: soupsieve==2.9.2
 Requires-Dist: tiktoken==0.12.0
 Requires-Dist: tokenizers==0.22.2
 Requires-Dist: tqdm==4.67.3
@@ -346,7 +346,8 @@ refused whether it sits inside the repository or outside it.
 
 **The repository's own config is not trusted.** A `.patch.conf.yml` or `.env` discovered inside
 the repository cannot set execution-capable options (`test`, `test-cmd`, `lint-cmd`, `load`,
-`notifications-command`, `editor`, `verify-ssl`, `git-commit-verify`) or environment variables
+`notifications-command`, `editor`, `verify-ssl`, `git-commit-verify`, `allow-private-urls`,
+`gui-address`) or environment variables
 that redirect API endpoints or proxies (`*_API_BASE`, `*_BASE_URL`, `HTTP(S)_PROXY`,
 `REQUESTS_CA_BUNDLE`, ...). Nor can it name another file for Patch to trust — `env-file`,
 `model-settings-file` and `model-metadata-file` are refused from repository config for that reason.
@@ -364,6 +365,19 @@ Pass `--trust-repo-config` to opt back in for a repository you trust. You can al
 `PATCH_TRUST_REPO_CONFIG` in your shell. The setting is ignored when it comes from the repository's
 own config or `.env`, so a repository cannot grant itself trust.
 
+**Scraping stays on public addresses.** `/web`, and any URL Patch fetches on your behalf, is
+refused when it resolves to a private, loopback or link-local address. Cloud metadata services
+answer on `169.254.169.254` and hand out IAM credentials to whatever asks, and the URL usually
+comes from the repository — a README is enough to aim it. Names are checked after resolution, so a
+hostname with an A record pointing at a private address is refused too, as is a redirect that
+arrives at one. Pass `--allow-private-urls` to scrape a local dev server deliberately; a repository
+config cannot set it.
+
+**The browser UI listens on this machine only.** `--browser` / `--gui` binds `127.0.0.1`. The UI
+has no authentication and can edit your repository and spend your API credits, so it is not
+something to put on a shared network by accident. `--gui-address ADDR` moves it deliberately —
+`--gui-address 0.0.0.0` accepts connections from anywhere and says so at startup.
+
 **Running in a container.** The boundary above distinguishes your files from the repository's by
 comparing against your home directory, so do not set `HOME` to the directory you mount the project
 into — the two become indistinguishable and every filter above stops applying. The bundled

{patch_chat-0.4.0 → patch_chat-0.5.0}/README.md

@@ -94,7 +94,8 @@ refused whether it sits inside the repository or outside it.
 
 **The repository's own config is not trusted.** A `.patch.conf.yml` or `.env` discovered inside
 the repository cannot set execution-capable options (`test`, `test-cmd`, `lint-cmd`, `load`,
-`notifications-command`, `editor`, `verify-ssl`, `git-commit-verify`) or environment variables
+`notifications-command`, `editor`, `verify-ssl`, `git-commit-verify`, `allow-private-urls`,
+`gui-address`) or environment variables
 that redirect API endpoints or proxies (`*_API_BASE`, `*_BASE_URL`, `HTTP(S)_PROXY`,
 `REQUESTS_CA_BUNDLE`, ...). Nor can it name another file for Patch to trust — `env-file`,
 `model-settings-file` and `model-metadata-file` are refused from repository config for that reason.
@@ -112,6 +113,19 @@ Pass `--trust-repo-config` to opt back in for a repository you trust. You can al
 `PATCH_TRUST_REPO_CONFIG` in your shell. The setting is ignored when it comes from the repository's
 own config or `.env`, so a repository cannot grant itself trust.
 
+**Scraping stays on public addresses.** `/web`, and any URL Patch fetches on your behalf, is
+refused when it resolves to a private, loopback or link-local address. Cloud metadata services
+answer on `169.254.169.254` and hand out IAM credentials to whatever asks, and the URL usually
+comes from the repository — a README is enough to aim it. Names are checked after resolution, so a
+hostname with an A record pointing at a private address is refused too, as is a redirect that
+arrives at one. Pass `--allow-private-urls` to scrape a local dev server deliberately; a repository
+config cannot set it.
+
+**The browser UI listens on this machine only.** `--browser` / `--gui` binds `127.0.0.1`. The UI
+has no authentication and can edit your repository and spend your API credits, so it is not
+something to put on a shared network by accident. `--gui-address ADDR` moves it deliberately —
+`--gui-address 0.0.0.0` accepts connections from anywhere and says so at startup.
+
 **Running in a container.** The boundary above distinguishes your files from the repository's by
 comparing against your home directory, so do not set `HOME` to the directory you mount the project
 into — the two become indistinguishable and every filter above stops applying. The bundled

{patch_chat-0.4.0 → patch_chat-0.5.0}/patch/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.4.0'
-__version_tuple__ = version_tuple = (0, 4, 0)
+__version__ = version = '0.5.0'
+__version_tuple__ = version_tuple = (0, 5, 0)
 
-__commit_id__ = commit_id = 'g890bad605'
+__commit_id__ = commit_id = 'g5ca14cb5c'

{patch_chat-0.4.0 → patch_chat-0.5.0}/patch/args.py

@@ -669,6 +669,15 @@ def get_parser(default_config_files, git_root):
         help="Run Patch in your browser (default: False)",
         default=False,
     )
+    group.add_argument(
+        "--gui-address",
+        metavar="ADDR",
+        default="127.0.0.1",
+        help=(
+            "Address the browser UI listens on (default: 127.0.0.1, this machine only)."
+            " Use 0.0.0.0 to expose it to your network -- it has no authentication."
+        ),
+    )
     group.add_argument(
         "--copy-paste",
         action=argparse.BooleanOptionalAction,
@@ -735,6 +744,15 @@ def get_parser(default_config_files, git_root):
         help="Never prompt for or attempt to install Playwright for web scraping (default: False).",
         default=False,
     )
+    group.add_argument(
+        "--allow-private-urls",
+        action="store_true",
+        help=(
+            "Scrape private, loopback and link-local addresses, such as a local dev server."
+            " Refused by default because cloud metadata services answer there (default: False)."
+        ),
+        default=False,
+    )
     group.add_argument(
         "--file",
         action="append",
@@ -865,6 +883,15 @@ def get_parser(default_config_files, git_root):
         default=True,
         help="Enable/disable detection and offering to add URLs to chat (default: True)",
     )
+    group.add_argument(
+        "--detect-file-mentions",
+        action=argparse.BooleanOptionalAction,
+        default=True,
+        help=(
+            "Enable/disable offering to add files the model mentions to the chat"
+            " (default: True). Turn it off to keep the context to what you add yourself."
+        ),
+    )
     group.add_argument(
         "--editor",
         help="Specify which editor to use for the /editor command",

{patch_chat-0.4.0 → patch_chat-0.5.0}/patch/coders/base_coder.py

@@ -137,6 +137,7 @@ class Coder:
     num_cache_warming_pings = 0
     suggest_shell_commands = True
     detect_urls = True
+    detect_file_mentions = True
     ignore_mentions = None
     chat_language = None
     commit_language = None
@@ -368,6 +369,7 @@ class Coder:
         chat_language=None,
         commit_language=None,
         detect_urls=True,
+        detect_file_mentions=True,
         ignore_mentions=None,
         total_tokens_sent=0,
         total_tokens_received=0,
@@ -400,6 +402,7 @@ class Coder:
 
         self.suggest_shell_commands = suggest_shell_commands
         self.detect_urls = detect_urls
+        self.detect_file_mentions = detect_file_mentions
 
         self.num_cache_warming_pings = num_cache_warming_pings
 
@@ -1794,15 +1797,17 @@ class Coder:
         else:
             content = ""
 
+        add_rel_files_message = None
+
         if not interrupted:
             add_rel_files_message = self.check_for_file_mentions(content)
-            if add_rel_files_message:
-                if self.reflected_message:
-                    self.reflected_message += "\n\n" + add_rel_files_message
-                else:
-                    self.reflected_message = add_rel_files_message
-                return
 
+        # A reply that both edits files and asks for more used to return here,
+        # above apply_updates, so its edits were dropped on the floor. The model
+        # was then told the files were added and carried on believing its edit
+        # had landed -- and the next one failed to match, because it never had.
+        # The edits are applied below first; the reflection happens after.
+        if not interrupted and not add_rel_files_message:
             try:
                 if self.reply_completed():
                     return
@@ -1830,6 +1835,13 @@ class Coder:
 
             self.move_back_cur_messages(saved_message)
 
+        if add_rel_files_message:
+            if self.reflected_message:
+                self.reflected_message += "\n\n" + add_rel_files_message
+            else:
+                self.reflected_message = add_rel_files_message
+            return
+
         if self.reflected_message:
             return
 
@@ -1999,6 +2011,9 @@ class Coder:
         return mentioned_rel_fnames
 
     def check_for_file_mentions(self, content):
+        if not self.detect_file_mentions:
+            return
+
         mentioned_rel_fnames = self.get_file_mentions(content)
 
         new_mentions = mentioned_rel_fnames - self.ignore_mentions

{patch_chat-0.4.0 → patch_chat-0.5.0}/patch/coders/wholefile_coder.py

@@ -28,6 +28,33 @@ class WholeFileCoder(Coder):
         fname = fname.lstrip("#")
         return fname.strip()
 
+    def nested_fence_delta(self, line):
+        """+1 if `line` opens a block nested inside a listing, -1 if it closes one.
+
+        A markdown file legitimately contains fenced code blocks, and a model
+        writes the same three backticks for the inner block as for the listing
+        wrapped around it. When the opening and closing markers are identical,
+        an info string ("```json") is the only thing distinguishing one from the
+        other, so that is what this reads.
+
+        A language-less inner block ("```" alone opening a code sample) stays
+        ambiguous -- nothing in the text separates it from the fence that ends
+        the listing -- and is still read as the end of the listing.
+        """
+        open_fence, close_fence = self.fence
+
+        if open_fence != close_fence:
+            if line.startswith(open_fence):
+                return 1
+            if line.startswith(close_fence):
+                return -1
+            return 0
+
+        if not line.startswith(open_fence):
+            return 0
+
+        return 1 if line[len(open_fence) :].strip() else -1
+
     def fence_fname(self, lines, i, chat_files):
         """The file the fence at `lines[i]` is listing, or None if that line names none.
 
@@ -60,12 +87,21 @@ class WholeFileCoder(Coder):
 
         diff_fences = ("```diff", "```patch", f"{self.fence[0]}diff", f"{self.fence[0]}patch")
         in_listing = False
+        listing_depth = 0
         diff_fence = None
         diff_header = None
         for i, line in enumerate(lines[:-1]):
             if in_listing:
-                if line.startswith(self.fence[1]):
-                    in_listing = False
+                # Fenced blocks inside the listing are content, not the end of
+                # it -- including a ```diff block in a file that documents one.
+                delta = self.nested_fence_delta(line)
+                if delta > 0:
+                    listing_depth += 1
+                elif delta < 0:
+                    if listing_depth:
+                        listing_depth -= 1
+                    else:
+                        in_listing = False
                 continue
 
             if line.startswith(diff_fences):
@@ -100,11 +136,29 @@ class WholeFileCoder(Coder):
         fname = None
         fname_source = None
         new_lines = []
+        depth = 0
         for i, line in enumerate(lines):
-            if line.startswith(self.fence[0]) or line.startswith(self.fence[1]):
+            is_fence = line.startswith(self.fence[0]) or line.startswith(self.fence[1])
+
+            if is_fence and fname is not None:
+                # The listing ends at its own closing fence, not at the first
+                # fence inside it. Reading an inner block as the end truncated
+                # the file there and wrote everything after it to a file named
+                # after whatever line happened to precede the next fence.
+                if self.nested_fence_delta(line) > 0:
+                    depth += 1
+                    new_lines.append(line)
+                    continue
+                if depth:
+                    depth -= 1
+                    new_lines.append(line)
+                    continue
+
+            if is_fence:
                 if fname is not None:
                     # ending an existing block
                     saw_fname = None
+                    depth = 0
 
                     full_path = self.abs_root_path(fname)
 

{patch_chat-0.4.0 → patch_chat-0.5.0}/patch/commands.py

@@ -278,6 +278,7 @@ class Commands:
                 playwright_available=res,
                 verify_ssl=self.verify_ssl,
                 confirm_ask=self.io.confirm_ask,
+                allow_private_urls=getattr(self.args, "allow_private_urls", False),
             )
 
         content = self.scraper.scrape(url) or ""

{patch_chat-0.4.0 → patch_chat-0.5.0}/patch/main.py

@@ -228,7 +228,7 @@ def write_streamlit_credentials():
         print("Streamlit credentials already exist.")
 
 
-def launch_gui(args):
+def launch_gui(args, address="127.0.0.1"):
     from streamlit.web import cli
 
     from patch import gui
@@ -243,7 +243,16 @@ def launch_gui(args):
 
     st_args = ["run", target]
 
+    # Streamlit binds every interface when it is not told otherwise, which put
+    # an unauthenticated UI holding the user's repository and API keys on the
+    # local network for anyone who ran --browser on a shared wifi. Loopback is
+    # the default; --gui-address is how you opt out of it.
+    if address not in ("127.0.0.1", "localhost", "::1"):
+        print(f"Warning: the browser UI will accept connections on {address}.")
+        print("It has no authentication: anyone who can reach it can edit your repository.")
+
     st_args += [
+        f"--server.address={address}",
         "--browser.gatherUsageStats=false",
         "--runner.magicEnabled=false",
         "--server.runOnSave=false",
@@ -980,7 +989,7 @@ def main(argv=None, input=None, output=None, force_git_root=None, return_coder=F
             analytics.event("exit", reason="Streamlit not installed")
             return
         analytics.event("gui session")
-        launch_gui(argv)
+        launch_gui(argv, args.gui_address)
         analytics.event("exit", reason="GUI session ended")
         return
 
@@ -1187,6 +1196,7 @@ def main(argv=None, input=None, output=None, force_git_root=None, return_coder=F
             chat_language=args.chat_language,
             commit_language=args.commit_language,
             detect_urls=args.detect_urls,
+            detect_file_mentions=args.detect_file_mentions,
             auto_copy_context=args.copy_paste,
             auto_accept_architect=args.auto_accept_architect,
             add_gitignore_files=args.add_gitignore_files,

{patch_chat-0.4.0 → patch_chat-0.5.0}/patch/repo.py

@@ -171,6 +171,15 @@ class GitRepo:
         - User commit with explicit no-committer: patch_edits=False,
           --no-attribute-committer -> Author=You, Committer=You
         """
+        if not fnames and self.subtree_only:
+            # `git commit -a` commits every dirty file in the repository, which
+            # is not what --subtree-only asked for: the session is scoped to one
+            # directory, and sweeping in unrelated work elsewhere in the tree is
+            # a commit the user cannot see coming. Name the files instead.
+            fnames = [f for f in self.get_dirty_files() if self.path_in_subtree(f)]
+            if not fnames:
+                return
+
         if not fnames and not self.repo.is_dirty():
             return
 
@@ -527,20 +536,31 @@ class GitRepo:
         self.ignore_file_cache[fname] = result
         return result
 
-    def ignored_file_raw(self, fname):
-        if self.subtree_only:
-            try:
-                fname_path = Path(self.normalize_path(fname))
-                cwd_path = Path.cwd().resolve().relative_to(Path(self.root).resolve())
-            except ValueError:
-                # Issue #1524
-                # ValueError: 'C:\\dev\\squid-certbot' is not in the subpath of
-                # 'C:\\dev\\squid-certbot'
-                # Clearly, fname is not under cwd... so ignore it
-                return True
+    def path_in_subtree(self, fname):
+        """Is `fname` inside the subtree this session is scoped to?
 
-            if cwd_path not in fname_path.parents and fname_path != cwd_path:
-                return True
+        Always True without `--subtree-only`, which is what scopes it. Every
+        question about that scope goes through here, so committing and ignoring
+        cannot drift apart on what "in the subtree" means.
+        """
+        if not self.subtree_only:
+            return True
+
+        try:
+            fname_path = Path(self.normalize_path(fname))
+            cwd_path = Path.cwd().resolve().relative_to(Path(self.root).resolve())
+        except ValueError:
+            # Issue #1524
+            # ValueError: 'C:\\dev\\squid-certbot' is not in the subpath of
+            # 'C:\\dev\\squid-certbot'
+            # Clearly, fname is not under cwd... so it is not in the subtree
+            return False
+
+        return cwd_path in fname_path.parents or fname_path == cwd_path
+
+    def ignored_file_raw(self, fname):
+        if not self.path_in_subtree(fname):
+            return True
 
         if not self.patch_ignore_file or not self.patch_ignore_file.is_file():
             return False

{patch_chat-0.4.0 → patch_chat-0.5.0}/patch/repo_trust.py

@@ -55,6 +55,13 @@ EXECUTION_KEYS = {
     "editor",
     "verify-ssl",
     "git-commit-verify",
+    # The repository is the one supplying the URLs -- a README pointing at
+    # 169.254.169.254 plus `allow-private-urls: true` in its own config is the
+    # whole attack, assembled from two files it controls.
+    "allow-private-urls",
+    # Moves an unauthenticated UI holding this repository and the user's keys
+    # off loopback and onto the network.
+    "gui-address",
 }
 
 # Substitute credentials or redirect where prompts and code are sent. The .env
@@ -151,6 +158,7 @@ REVIEWED_SAFE_KEYS = {
     "editor-edit-format": "an edit-format name",
     "encoding": "a codec name",
     "line-endings": "an enum",
+    "detect-file-mentions": "a boolean; whether to offer to add mentioned files, still confirmed",
 }