patchpal 0.24.0__tar.gz → 0.24.1__tar.gz

{patchpal-0.24.0/patchpal.egg-info → patchpal-0.24.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: patchpal
-Version: 0.24.0
+Version: 0.24.1
 Summary: An agentic coding and automation assistant, supporting both local and cloud LLMs
 Author: PatchPal Contributors
 License-Expression: Apache-2.0

{patchpal-0.24.0 → patchpal-0.24.1}/patchpal/__init__.py

@@ -1,6 +1,6 @@
 """PatchPal - An open-source Claude Code clone implemented purely in Python."""
 
-__version__ = "0.24.0"
+__version__ = "0.24.1"
 
 from patchpal.agent import create_agent, create_react_agent
 from patchpal.cli.autopilot import autopilot_loop

{patchpal-0.24.0 → patchpal-0.24.1}/patchpal/cli/sandbox.py

@@ -18,11 +18,17 @@ import sys
 
 
 def load_env_file(env_file):
-    """Load environment variables from .env file."""
+    """Load environment variables from .env file.
+
+    Returns:
+        set: Keys of the environment variables that were loaded from the file.
+    """
     if not os.path.exists(env_file):
         print(f"❌ Error: .env file not found: {env_file}", file=sys.stderr)
         sys.exit(1)
 
+    loaded_keys = set()
+
     with open(env_file, "r") as f:
         for line in f:
             line = line.strip()
@@ -43,6 +49,9 @@ def load_env_file(env_file):
                     value = value[1:-1]
 
                 os.environ[key] = value
+                loaded_keys.add(key)
+
+    return loaded_keys
 
 
 def detect_runtime():
@@ -354,8 +363,17 @@ echo ""
     return script
 
 
-def build_container_args(sandbox_args, patchpal_args):
-    """Build container runtime arguments."""
+def build_container_args(sandbox_args, patchpal_args, env_file_keys=None):
+    """Build container runtime arguments.
+
+    Args:
+        sandbox_args: Parsed sandbox CLI arguments
+        patchpal_args: Arguments to pass through to patchpal
+        env_file_keys: Set of env var names loaded from --env-file (if any).
+                       These are forwarded into the container even though the
+                       rest of the host environment is not (isolation mode).
+    """
+    env_file_keys = env_file_keys or set()
     runtime = detect_runtime()
     if not runtime:
         print("❌ Error: Neither Docker nor Podman found", file=sys.stderr)
@@ -456,8 +474,12 @@ def build_container_args(sandbox_args, patchpal_args):
     if sandbox_args.cpus:
         container_args.extend(["--cpus", str(sandbox_args.cpus)])
 
-    # Pass through environment variables from host ONLY if --env-file is NOT provided
-    # This provides better isolation - when using --env-file, only those specific vars are used
+    # Pass through environment variables.
+    # WITHOUT --env-file: pass through matching vars from the full host environment.
+    # WITH --env-file: isolate from the host, but still forward the vars that were
+    #                  explicitly loaded from the file itself (previously these were
+    #                  loaded into os.environ but never forwarded into the container,
+    #                  causing credentials in --env-file to be silently dropped).
     if not sandbox_args.env_file:
         # Pass through PATCHPAL_* environment variables
         for key, value in os.environ.items():
@@ -496,6 +518,12 @@ def build_container_args(sandbox_args, patchpal_args):
         for key, value in os.environ.items():
             if key.startswith("OLLAMA_"):
                 container_args.extend(["-e", f"{key}={value}"])
+    else:
+        # Isolated mode: only forward the specific vars loaded from --env-file
+        for key in env_file_keys:
+            value = os.environ.get(key)
+            if value is not None:
+                container_args.extend(["-e", f"{key}={value}"])
 
     # Track mounted paths to avoid duplicates
     mounted_paths = set()
@@ -1002,9 +1030,10 @@ def main():
         sandbox_args.network = "host"
 
     # Load .env file if specified
+    env_file_keys = set()
     if sandbox_args.env_file:
         print(f"Loading environment variables from: {sandbox_args.env_file}")
-        load_env_file(sandbox_args.env_file)
+        env_file_keys = load_env_file(sandbox_args.env_file)
 
     # If LITELLM_KWARGS contains AWS params, normalize env var names to uppercase
     # This must happen before endpoint detection for AWS Bedrock auto-detection to work
@@ -1023,6 +1052,7 @@ def main():
                     upper_key = key.upper()
                     if upper_key not in os.environ:
                         os.environ[upper_key] = value
+                    env_file_keys.add(upper_key)
         except (json.JSONDecodeError, ValueError):
             # Not JSON, check if individual env vars exist (comma-separated format)
             for key, value in list(os.environ.items()):
@@ -1030,6 +1060,7 @@ def main():
                     upper_key = key.upper()
                     if upper_key not in os.environ:
                         os.environ[upper_key] = value
+                    env_file_keys.add(upper_key)
 
     # Auto-detect LLM endpoints if network restrictions are enabled
     detected_endpoints = []
@@ -1060,7 +1091,7 @@ def main():
             )
 
     # Build container command
-    container_args, runtime = build_container_args(sandbox_args, patchpal_argv)
+    container_args, runtime = build_container_args(sandbox_args, patchpal_argv, env_file_keys)
 
     # Show what we're doing
     print(f"Using container runtime: {runtime}")

{patchpal-0.24.0 → patchpal-0.24.1}/patchpal/tools/shell_tools.py

@@ -169,7 +169,11 @@ def _extract_shell_command_info(cmd: str) -> tuple[Optional[str], Optional[str]]
 
     # Shell operators that indicate compound commands
     # Split by && and || first (they group tighter than ;)
-    compound_operators = ["&&", "||", ";"]
+    # IMPORTANT: newline is also a command separator - without splitting on it, a
+    # multi-line command like "cd /tmp\npython evil.py" would be tokenized as one
+    # blob and misidentified as just "cd" (which is auto-granted as harmless),
+    # completely bypassing the permission check for the real command on the second line.
+    compound_operators = ["&&", "||", ";", "\n"]
 
     # Split by compound operators to find all sub-commands
     commands = [cmd]

{patchpal-0.24.0 → patchpal-0.24.1}/patchpal/tools/web_tools.py

@@ -289,9 +289,21 @@ class URLContextTracker:
         # Note: Apostrophes (') are allowed in URLs (e.g., Wikipedia article titles)
         import re
 
-        url_pattern = r"https?://[^\s<>\"\)]*"
+        url_pattern = r"https?://[^\s<>\"]*"
         urls = re.findall(url_pattern, text)
-        self.seen_urls.update(urls)
+
+        # Strip trailing punctuation that commonly follows URLs in natural language
+        # but is not part of the URL itself
+        cleaned_urls = []
+        for url in urls:
+            # Strip trailing punctuation: , ; . ! ? )
+            # but preserve these characters if they appear mid-URL
+            while url and url[-1] in ".,;!?)":
+                url = url[:-1]
+            if url:  # Only add non-empty URLs
+                cleaned_urls.append(url)
+
+        self.seen_urls.update(cleaned_urls)
 
     def is_url_in_context(self, url: str) -> bool:
         """Check if URL has appeared in conversation context.

{patchpal-0.24.0 → patchpal-0.24.1/patchpal.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: patchpal
-Version: 0.24.0
+Version: 0.24.1
 Summary: An agentic coding and automation assistant, supporting both local and cloud LLMs
 Author: PatchPal Contributors
 License-Expression: Apache-2.0

{patchpal-0.24.0 → patchpal-0.24.1}/tests/test_permissions.py

@@ -48,6 +48,34 @@ def test_shell_command_pattern_with_cd():
     assert wd == "/tmp"
 
 
+def test_shell_command_pattern_newline_separated():
+    """Regression test: newline-separated commands must not bypass permission checks.
+
+    Bug: _extract_shell_command_info() only split on &&, ||, and ; - not newlines.
+    A command like "cd /tmp\npython evil.py" (cd and the real command on separate
+    lines, with no shell operator joining them) was tokenized as a single blob and
+    misidentified as just "cd", which is on the harmless auto-grant list. This let
+    an arbitrary second-line command execute without ever triggering a permission
+    prompt. See conversation history for full root-cause analysis.
+    """
+    from patchpal.tools.shell_tools import _extract_shell_command_info
+
+    # Basic two-line case: cd on line 1, real command on line 2
+    cmd, wd = _extract_shell_command_info("cd /tmp\npython evil.py")
+    assert cmd == "python"  # Must NOT be "cd"
+    assert wd == "/tmp"
+
+    # Multi-line with || fallback on line 1 (the exact bypass pattern reported)
+    cmd, wd = _extract_shell_command_info(
+        'cd /repo/a 2>/dev/null || cd /repo/b\npython3 -c "print(1)"'
+    )
+    assert cmd == "python3"  # Must NOT be "cd"
+
+    # Newline-separated dangerous command must also be detected (not swallowed as "cd")
+    cmd, wd = _extract_shell_command_info("cd /tmp\nrm -rf /")
+    assert cmd == "rm"  # Must NOT be "cd" - "rm" must surface so DANGEROUS_PATTERNS can catch it
+
+
 def test_shell_command_pattern_with_pipes():
     """Test shell command pattern extraction with pipes."""
     from patchpal.tools.shell_tools import _extract_shell_command_info

{patchpal-0.24.0 → patchpal-0.24.1}/tests/test_tools.py

@@ -679,6 +679,44 @@ def test_web_fetch_invalid_url():
         web_fetch("not-a-url")
 
 
+def test_url_extraction_with_punctuation():
+    """Test that URLs followed by punctuation are extracted correctly."""
+    from patchpal.tools.web_tools import URLContextTracker
+
+    tracker = URLContextTracker()
+
+    # Test URL followed by comma (the bug that was fixed)
+    tracker.clear()
+    tracker.add_urls_from_text("Based on https://en.wikipedia.org/robots.txt, is this okay?")
+    assert tracker.is_url_in_context("https://en.wikipedia.org/robots.txt")
+
+    # Test URL followed by period
+    tracker.clear()
+    tracker.add_urls_from_text("Check out https://example.com. It's great!")
+    assert tracker.is_url_in_context("https://example.com")
+
+    # Test URL followed by semicolon
+    tracker.clear()
+    tracker.add_urls_from_text("Visit https://docs.python.org; it has good info.")
+    assert tracker.is_url_in_context("https://docs.python.org")
+
+    # Test URL in parentheses
+    tracker.clear()
+    tracker.add_urls_from_text("Link (https://www.google.com) is here.")
+    assert tracker.is_url_in_context("https://www.google.com")
+
+    # Test multiple URLs with different punctuation
+    tracker.clear()
+    tracker.add_urls_from_text("Multiple: https://site1.com, https://site2.com.")
+    assert tracker.is_url_in_context("https://site1.com")
+    assert tracker.is_url_in_context("https://site2.com")
+
+    # Test URL with apostrophe (should be preserved - part of URL)
+    tracker.clear()
+    tracker.add_urls_from_text("URL: https://en.wikipedia.org/wiki/O'Brien works")
+    assert tracker.is_url_in_context("https://en.wikipedia.org/wiki/O'Brien")
+
+
 def test_web_fetch_content_too_large(monkeypatch):
     """Test that large content is rejected."""
     from unittest.mock import Mock