patchpal 0.24.0__tar.gz → 0.24.2__tar.gz

{patchpal-0.24.0/patchpal.egg-info → patchpal-0.24.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: patchpal
-Version: 0.24.0
+Version: 0.24.2
 Summary: An agentic coding and automation assistant, supporting both local and cloud LLMs
 Author: PatchPal Contributors
 License-Expression: Apache-2.0

{patchpal-0.24.0 → patchpal-0.24.2}/patchpal/__init__.py

@@ -1,6 +1,6 @@
 """PatchPal - An open-source Claude Code clone implemented purely in Python."""
 
-__version__ = "0.24.0"
+__version__ = "0.24.2"
 
 from patchpal.agent import create_agent, create_react_agent
 from patchpal.cli.autopilot import autopilot_loop

{patchpal-0.24.0 → patchpal-0.24.2}/patchpal/agent/bedrock_profile_utils.py

@@ -29,8 +29,33 @@ def _extract_model_from_arn(arn: str) -> str | None:
         else:
             region = os.getenv("AWS_REGION_NAME") or os.getenv("AWS_REGION") or "us-east-1"
 
+        # Check for custom Bedrock endpoint (VPC endpoint, custom domain, etc.)
+        # The control plane and runtime may use the same VPC endpoint base
+        custom_endpoint = (
+            os.getenv("AWS_BEDROCK_ENDPOINT")
+            or os.getenv("AWS_ENDPOINT_URL_BEDROCK")
+            or os.getenv("AWS_ENDPOINT_URL")
+        )
+
+        # CRITICAL FIX: Derive control plane endpoint from runtime VPC endpoint
+        # Scenario: User has VPC endpoint for runtime but not explicit control plane endpoint
+        # Problem: boto3.client("bedrock") defaults to public endpoint, not VPC endpoint
+        # Solution: Automatically derive control plane VPC endpoint from runtime endpoint
+        # VPC endpoint pattern:
+        #   Runtime:        vpce-{id}.bedrock-runtime.{region}.vpce.amazonaws.com
+        #   Control plane:  vpce-{id}.bedrock.{region}.vpce.amazonaws.com
+        # This matches the automatic derivation in sandbox.py endpoint detection
+        if custom_endpoint and "bedrock-runtime" in custom_endpoint:
+            # Try to construct control plane VPC endpoint by removing -runtime
+            control_endpoint = custom_endpoint.replace("bedrock-runtime", "bedrock")
+        else:
+            control_endpoint = custom_endpoint
+
         # Create bedrock client
-        bedrock = boto3.client("bedrock", region_name=region)
+        if control_endpoint:
+            bedrock = boto3.client("bedrock", region_name=region, endpoint_url=control_endpoint)
+        else:
+            bedrock = boto3.client("bedrock", region_name=region)
 
         # Get inference profile details
         response = bedrock.get_inference_profile(inferenceProfileIdentifier=arn)

{patchpal-0.24.0 → patchpal-0.24.2}/patchpal/cli/sandbox.py

@@ -18,11 +18,17 @@ import sys
 
 
 def load_env_file(env_file):
-    """Load environment variables from .env file."""
+    """Load environment variables from .env file.
+
+    Returns:
+        set: Keys of the environment variables that were loaded from the file.
+    """
     if not os.path.exists(env_file):
         print(f"❌ Error: .env file not found: {env_file}", file=sys.stderr)
         sys.exit(1)
 
+    loaded_keys = set()
+
     with open(env_file, "r") as f:
         for line in f:
             line = line.strip()
@@ -43,6 +49,9 @@ def load_env_file(env_file):
                     value = value[1:-1]
 
                 os.environ[key] = value
+                loaded_keys.add(key)
+
+    return loaded_keys
 
 
 def detect_runtime():
@@ -135,6 +144,7 @@ def detect_llm_endpoints_from_env():
         "ANTHROPIC_API_BASE",
         "AWS_BEDROCK_ENDPOINT",
         "AWS_ENDPOINT_URL_BEDROCK_RUNTIME",
+        "AWS_ENDPOINT_URL_BEDROCK",  # Control plane endpoint
         "AWS_ENDPOINT_URL",
         "AWS_BEDROCK_RUNTIME_ENDPOINT",
         "AZURE_OPENAI_ENDPOINT",
@@ -153,6 +163,18 @@ def detect_llm_endpoints_from_env():
             # Ensure it's a valid URL
             if value.startswith("http://") or value.startswith("https://"):
                 detected_urls.append(value)
+
+                # CRITICAL FIX: For Bedrock VPC endpoints, derive control plane endpoint
+                # Scenario: User has VPC endpoint for runtime API (e.g., AWS GovCloud private network)
+                # Problem: Model capability detection needs control plane API (get_inference_profile)
+                #          but boto3 doesn't automatically derive control plane from runtime endpoint
+                # VPC endpoint pattern:
+                #   Runtime:        vpce-{id}.bedrock-runtime.{region}.vpce.amazonaws.com
+                #   Control plane:  vpce-{id}.bedrock.{region}.vpce.amazonaws.com
+                # Without this, capability detection hangs trying to reach public control plane endpoint
+                if "bedrock-runtime" in value and ".vpce.amazonaws.com" in value:
+                    control_plane_url = value.replace("bedrock-runtime", "bedrock")
+                    detected_urls.append(control_plane_url)
             else:
                 # Assume https if no protocol specified
                 detected_urls.append(f"https://{value}")
@@ -168,18 +190,37 @@ def detect_llm_endpoints_from_env():
     if aws_region and (
         os.environ.get("AWS_ACCESS_KEY_ID") or os.environ.get("AWS_SECRET_ACCESS_KEY")
     ):
-        # Add Bedrock endpoint for the region
+        # Add Bedrock endpoints for the region
         # Support both GovCloud and standard regions
         # Also support AWS China regions
+
+        # IMPORTANT: boto3 uses standard endpoint names by default, even in GovCloud
+        # Only use -fips suffix if AWS_USE_FIPS_ENDPOINT=true is explicitly set
+        # Scenario 1: Standard GovCloud → bedrock.us-gov-east-1.amazonaws.com (boto3 default)
+        # Scenario 2: FIPS required → bedrock-fips.us-gov-east-1.amazonaws.com (explicit opt-in)
+        use_fips = os.environ.get("AWS_USE_FIPS_ENDPOINT", "").lower() == "true"
+
         if "gov" in aws_region:
-            # GovCloud regions use FIPS endpoints
-            detected_urls.append(f"https://bedrock-runtime-fips.{aws_region}.amazonaws.com")
+            # GovCloud regions
+            # Add both runtime (for LLM inference) and control plane (for model capability detection)
+            if use_fips:
+                # FIPS endpoints (only when explicitly requested via AWS_USE_FIPS_ENDPOINT=true)
+                detected_urls.append(f"https://bedrock-runtime-fips.{aws_region}.amazonaws.com")
+                detected_urls.append(f"https://bedrock-fips.{aws_region}.amazonaws.com")
+            else:
+                # Standard GovCloud endpoints (boto3 default behavior)
+                # This is what boto3 uses unless FIPS is explicitly configured
+                detected_urls.append(f"https://bedrock-runtime.{aws_region}.amazonaws.com")
+                detected_urls.append(f"https://bedrock.{aws_region}.amazonaws.com")
         elif "cn-" in aws_region:
-            # AWS China regions use .amazonaws.com.cn
+            # AWS China regions use .amazonaws.com.cn domain
             detected_urls.append(f"https://bedrock-runtime.{aws_region}.amazonaws.com.cn")
+            detected_urls.append(f"https://bedrock.{aws_region}.amazonaws.com.cn")
         else:
-            # Standard commercial regions
+            # Standard commercial regions (us-east-1, eu-west-1, etc.)
+            # Add both runtime (for LLM inference) and control plane (for model capability detection)
             detected_urls.append(f"https://bedrock-runtime.{aws_region}.amazonaws.com")
+            detected_urls.append(f"https://bedrock.{aws_region}.amazonaws.com")
 
     # Azure OpenAI: Extract from resource name if AZURE_OPENAI_KEY is set
     azure_key = os.environ.get("AZURE_OPENAI_KEY") or os.environ.get("AZURE_API_KEY")
@@ -267,9 +308,28 @@ fi
 # Configure iptables
 echo "Configuring firewall rules..."
 
-# Allow DNS (required for hostname resolution)
-iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
-iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
+# Extract DNS resolver IP(s) from /etc/resolv.conf
+# This locks DNS queries to only the container's configured resolver,
+# preventing agents from directly querying attacker-controlled DNS servers
+RESOLVER_IPS=$(grep '^nameserver' /etc/resolv.conf | awk '{print $2}')
+
+if [ -z "$RESOLVER_IPS" ]; then
+    echo "❌ ERROR: Could not detect DNS resolver from /etc/resolv.conf"
+    echo "Cannot configure secure DNS filtering without a resolver"
+    exit 1
+fi
+
+# Allow DNS ONLY to detected resolver IPs (SECURITY FIX)
+# This prevents the OpenAI-style DNS tunneling attack where agents
+# send DNS packets directly to attacker-controlled DNS servers
+echo "Locking DNS queries to container's resolver(s):"
+while IFS= read -r RESOLVER_IP; do
+    if [ -n "$RESOLVER_IP" ]; then
+        echo "  $RESOLVER_IP (DNS)"
+        iptables -A OUTPUT -d $RESOLVER_IP -p udp --dport 53 -j ACCEPT
+        iptables -A OUTPUT -d $RESOLVER_IP -p tcp --dport 53 -j ACCEPT
+    fi
+done <<< "$RESOLVER_IPS"
 
 # Allow localhost
 iptables -A OUTPUT -d 127.0.0.1/8 -j ACCEPT
@@ -354,8 +414,17 @@ echo ""
     return script
 
 
-def build_container_args(sandbox_args, patchpal_args):
-    """Build container runtime arguments."""
+def build_container_args(sandbox_args, patchpal_args, env_file_keys=None):
+    """Build container runtime arguments.
+
+    Args:
+        sandbox_args: Parsed sandbox CLI arguments
+        patchpal_args: Arguments to pass through to patchpal
+        env_file_keys: Set of env var names loaded from --env-file (if any).
+                       These are forwarded into the container even though the
+                       rest of the host environment is not (isolation mode).
+    """
+    env_file_keys = env_file_keys or set()
     runtime = detect_runtime()
     if not runtime:
         print("❌ Error: Neither Docker nor Podman found", file=sys.stderr)
@@ -456,8 +525,12 @@ def build_container_args(sandbox_args, patchpal_args):
     if sandbox_args.cpus:
         container_args.extend(["--cpus", str(sandbox_args.cpus)])
 
-    # Pass through environment variables from host ONLY if --env-file is NOT provided
-    # This provides better isolation - when using --env-file, only those specific vars are used
+    # Pass through environment variables.
+    # WITHOUT --env-file: pass through matching vars from the full host environment.
+    # WITH --env-file: isolate from the host, but still forward the vars that were
+    #                  explicitly loaded from the file itself (previously these were
+    #                  loaded into os.environ but never forwarded into the container,
+    #                  causing credentials in --env-file to be silently dropped).
     if not sandbox_args.env_file:
         # Pass through PATCHPAL_* environment variables
         for key, value in os.environ.items():
@@ -496,6 +569,12 @@ def build_container_args(sandbox_args, patchpal_args):
         for key, value in os.environ.items():
             if key.startswith("OLLAMA_"):
                 container_args.extend(["-e", f"{key}={value}"])
+    else:
+        # Isolated mode: only forward the specific vars loaded from --env-file
+        for key in env_file_keys:
+            value = os.environ.get(key)
+            if value is not None:
+                container_args.extend(["-e", f"{key}={value}"])
 
     # Track mounted paths to avoid duplicates
     mounted_paths = set()
@@ -1002,9 +1081,10 @@ def main():
         sandbox_args.network = "host"
 
     # Load .env file if specified
+    env_file_keys = set()
     if sandbox_args.env_file:
         print(f"Loading environment variables from: {sandbox_args.env_file}")
-        load_env_file(sandbox_args.env_file)
+        env_file_keys = load_env_file(sandbox_args.env_file)
 
     # If LITELLM_KWARGS contains AWS params, normalize env var names to uppercase
     # This must happen before endpoint detection for AWS Bedrock auto-detection to work
@@ -1023,6 +1103,7 @@ def main():
                     upper_key = key.upper()
                     if upper_key not in os.environ:
                         os.environ[upper_key] = value
+                    env_file_keys.add(upper_key)
         except (json.JSONDecodeError, ValueError):
             # Not JSON, check if individual env vars exist (comma-separated format)
             for key, value in list(os.environ.items()):
@@ -1030,6 +1111,7 @@ def main():
                     upper_key = key.upper()
                     if upper_key not in os.environ:
                         os.environ[upper_key] = value
+                    env_file_keys.add(upper_key)
 
     # Auto-detect LLM endpoints if network restrictions are enabled
     detected_endpoints = []
@@ -1060,7 +1142,7 @@ def main():
             )
 
     # Build container command
-    container_args, runtime = build_container_args(sandbox_args, patchpal_argv)
+    container_args, runtime = build_container_args(sandbox_args, patchpal_argv, env_file_keys)
 
     # Show what we're doing
     print(f"Using container runtime: {runtime}")

{patchpal-0.24.0 → patchpal-0.24.2}/patchpal/tools/shell_tools.py

@@ -169,7 +169,11 @@ def _extract_shell_command_info(cmd: str) -> tuple[Optional[str], Optional[str]]
 
     # Shell operators that indicate compound commands
     # Split by && and || first (they group tighter than ;)
-    compound_operators = ["&&", "||", ";"]
+    # IMPORTANT: newline is also a command separator - without splitting on it, a
+    # multi-line command like "cd /tmp\npython evil.py" would be tokenized as one
+    # blob and misidentified as just "cd" (which is auto-granted as harmless),
+    # completely bypassing the permission check for the real command on the second line.
+    compound_operators = ["&&", "||", ";", "\n"]
 
     # Split by compound operators to find all sub-commands
     commands = [cmd]

{patchpal-0.24.0 → patchpal-0.24.2}/patchpal/tools/web_tools.py

@@ -289,9 +289,21 @@ class URLContextTracker:
         # Note: Apostrophes (') are allowed in URLs (e.g., Wikipedia article titles)
         import re
 
-        url_pattern = r"https?://[^\s<>\"\)]*"
+        url_pattern = r"https?://[^\s<>\"]*"
         urls = re.findall(url_pattern, text)
-        self.seen_urls.update(urls)
+
+        # Strip trailing punctuation that commonly follows URLs in natural language
+        # but is not part of the URL itself
+        cleaned_urls = []
+        for url in urls:
+            # Strip trailing punctuation: , ; . ! ? )
+            # but preserve these characters if they appear mid-URL
+            while url and url[-1] in ".,;!?)":
+                url = url[:-1]
+            if url:  # Only add non-empty URLs
+                cleaned_urls.append(url)
+
+        self.seen_urls.update(cleaned_urls)
 
     def is_url_in_context(self, url: str) -> bool:
         """Check if URL has appeared in conversation context.

{patchpal-0.24.0 → patchpal-0.24.2/patchpal.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: patchpal
-Version: 0.24.0
+Version: 0.24.2
 Summary: An agentic coding and automation assistant, supporting both local and cloud LLMs
 Author: PatchPal Contributors
 License-Expression: Apache-2.0

{patchpal-0.24.0 → patchpal-0.24.2}/tests/test_permissions.py

@@ -48,6 +48,34 @@ def test_shell_command_pattern_with_cd():
     assert wd == "/tmp"
 
 
+def test_shell_command_pattern_newline_separated():
+    """Regression test: newline-separated commands must not bypass permission checks.
+
+    Bug: _extract_shell_command_info() only split on &&, ||, and ; - not newlines.
+    A command like "cd /tmp\npython evil.py" (cd and the real command on separate
+    lines, with no shell operator joining them) was tokenized as a single blob and
+    misidentified as just "cd", which is on the harmless auto-grant list. This let
+    an arbitrary second-line command execute without ever triggering a permission
+    prompt. See conversation history for full root-cause analysis.
+    """
+    from patchpal.tools.shell_tools import _extract_shell_command_info
+
+    # Basic two-line case: cd on line 1, real command on line 2
+    cmd, wd = _extract_shell_command_info("cd /tmp\npython evil.py")
+    assert cmd == "python"  # Must NOT be "cd"
+    assert wd == "/tmp"
+
+    # Multi-line with || fallback on line 1 (the exact bypass pattern reported)
+    cmd, wd = _extract_shell_command_info(
+        'cd /repo/a 2>/dev/null || cd /repo/b\npython3 -c "print(1)"'
+    )
+    assert cmd == "python3"  # Must NOT be "cd"
+
+    # Newline-separated dangerous command must also be detected (not swallowed as "cd")
+    cmd, wd = _extract_shell_command_info("cd /tmp\nrm -rf /")
+    assert cmd == "rm"  # Must NOT be "cd" - "rm" must surface so DANGEROUS_PATTERNS can catch it
+
+
 def test_shell_command_pattern_with_pipes():
     """Test shell command pattern extraction with pipes."""
     from patchpal.tools.shell_tools import _extract_shell_command_info

{patchpal-0.24.0 → patchpal-0.24.2}/tests/test_tools.py

@@ -679,6 +679,44 @@ def test_web_fetch_invalid_url():
         web_fetch("not-a-url")
 
 
+def test_url_extraction_with_punctuation():
+    """Test that URLs followed by punctuation are extracted correctly."""
+    from patchpal.tools.web_tools import URLContextTracker
+
+    tracker = URLContextTracker()
+
+    # Test URL followed by comma (the bug that was fixed)
+    tracker.clear()
+    tracker.add_urls_from_text("Based on https://en.wikipedia.org/robots.txt, is this okay?")
+    assert tracker.is_url_in_context("https://en.wikipedia.org/robots.txt")
+
+    # Test URL followed by period
+    tracker.clear()
+    tracker.add_urls_from_text("Check out https://example.com. It's great!")
+    assert tracker.is_url_in_context("https://example.com")
+
+    # Test URL followed by semicolon
+    tracker.clear()
+    tracker.add_urls_from_text("Visit https://docs.python.org; it has good info.")
+    assert tracker.is_url_in_context("https://docs.python.org")
+
+    # Test URL in parentheses
+    tracker.clear()
+    tracker.add_urls_from_text("Link (https://www.google.com) is here.")
+    assert tracker.is_url_in_context("https://www.google.com")
+
+    # Test multiple URLs with different punctuation
+    tracker.clear()
+    tracker.add_urls_from_text("Multiple: https://site1.com, https://site2.com.")
+    assert tracker.is_url_in_context("https://site1.com")
+    assert tracker.is_url_in_context("https://site2.com")
+
+    # Test URL with apostrophe (should be preserved - part of URL)
+    tracker.clear()
+    tracker.add_urls_from_text("URL: https://en.wikipedia.org/wiki/O'Brien works")
+    assert tracker.is_url_in_context("https://en.wikipedia.org/wiki/O'Brien")
+
+
 def test_web_fetch_content_too_large(monkeypatch):
     """Test that large content is rejected."""
     from unittest.mock import Mock