patchpal 0.24.1__tar.gz → 0.24.2__tar.gz

{patchpal-0.24.1/patchpal.egg-info → patchpal-0.24.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: patchpal
-Version: 0.24.1
+Version: 0.24.2
 Summary: An agentic coding and automation assistant, supporting both local and cloud LLMs
 Author: PatchPal Contributors
 License-Expression: Apache-2.0

{patchpal-0.24.1 → patchpal-0.24.2}/patchpal/__init__.py

@@ -1,6 +1,6 @@
 """PatchPal - An open-source Claude Code clone implemented purely in Python."""
 
-__version__ = "0.24.1"
+__version__ = "0.24.2"
 
 from patchpal.agent import create_agent, create_react_agent
 from patchpal.cli.autopilot import autopilot_loop

{patchpal-0.24.1 → patchpal-0.24.2}/patchpal/agent/bedrock_profile_utils.py

@@ -29,8 +29,33 @@ def _extract_model_from_arn(arn: str) -> str | None:
         else:
             region = os.getenv("AWS_REGION_NAME") or os.getenv("AWS_REGION") or "us-east-1"
 
+        # Check for custom Bedrock endpoint (VPC endpoint, custom domain, etc.)
+        # The control plane and runtime may use the same VPC endpoint base
+        custom_endpoint = (
+            os.getenv("AWS_BEDROCK_ENDPOINT")
+            or os.getenv("AWS_ENDPOINT_URL_BEDROCK")
+            or os.getenv("AWS_ENDPOINT_URL")
+        )
+
+        # CRITICAL FIX: Derive control plane endpoint from runtime VPC endpoint
+        # Scenario: User has VPC endpoint for runtime but not explicit control plane endpoint
+        # Problem: boto3.client("bedrock") defaults to public endpoint, not VPC endpoint
+        # Solution: Automatically derive control plane VPC endpoint from runtime endpoint
+        # VPC endpoint pattern:
+        #   Runtime:        vpce-{id}.bedrock-runtime.{region}.vpce.amazonaws.com
+        #   Control plane:  vpce-{id}.bedrock.{region}.vpce.amazonaws.com
+        # This matches the automatic derivation in sandbox.py endpoint detection
+        if custom_endpoint and "bedrock-runtime" in custom_endpoint:
+            # Try to construct control plane VPC endpoint by removing -runtime
+            control_endpoint = custom_endpoint.replace("bedrock-runtime", "bedrock")
+        else:
+            control_endpoint = custom_endpoint
+
         # Create bedrock client
-        bedrock = boto3.client("bedrock", region_name=region)
+        if control_endpoint:
+            bedrock = boto3.client("bedrock", region_name=region, endpoint_url=control_endpoint)
+        else:
+            bedrock = boto3.client("bedrock", region_name=region)
 
         # Get inference profile details
         response = bedrock.get_inference_profile(inferenceProfileIdentifier=arn)

{patchpal-0.24.1 → patchpal-0.24.2}/patchpal/cli/sandbox.py

@@ -144,6 +144,7 @@ def detect_llm_endpoints_from_env():
         "ANTHROPIC_API_BASE",
         "AWS_BEDROCK_ENDPOINT",
         "AWS_ENDPOINT_URL_BEDROCK_RUNTIME",
+        "AWS_ENDPOINT_URL_BEDROCK",  # Control plane endpoint
         "AWS_ENDPOINT_URL",
         "AWS_BEDROCK_RUNTIME_ENDPOINT",
         "AZURE_OPENAI_ENDPOINT",
@@ -162,6 +163,18 @@ def detect_llm_endpoints_from_env():
             # Ensure it's a valid URL
             if value.startswith("http://") or value.startswith("https://"):
                 detected_urls.append(value)
+
+                # CRITICAL FIX: For Bedrock VPC endpoints, derive control plane endpoint
+                # Scenario: User has VPC endpoint for runtime API (e.g., AWS GovCloud private network)
+                # Problem: Model capability detection needs control plane API (get_inference_profile)
+                #          but boto3 doesn't automatically derive control plane from runtime endpoint
+                # VPC endpoint pattern:
+                #   Runtime:        vpce-{id}.bedrock-runtime.{region}.vpce.amazonaws.com
+                #   Control plane:  vpce-{id}.bedrock.{region}.vpce.amazonaws.com
+                # Without this, capability detection hangs trying to reach public control plane endpoint
+                if "bedrock-runtime" in value and ".vpce.amazonaws.com" in value:
+                    control_plane_url = value.replace("bedrock-runtime", "bedrock")
+                    detected_urls.append(control_plane_url)
             else:
                 # Assume https if no protocol specified
                 detected_urls.append(f"https://{value}")
@@ -177,18 +190,37 @@ def detect_llm_endpoints_from_env():
     if aws_region and (
         os.environ.get("AWS_ACCESS_KEY_ID") or os.environ.get("AWS_SECRET_ACCESS_KEY")
     ):
-        # Add Bedrock endpoint for the region
+        # Add Bedrock endpoints for the region
         # Support both GovCloud and standard regions
         # Also support AWS China regions
+
+        # IMPORTANT: boto3 uses standard endpoint names by default, even in GovCloud
+        # Only use -fips suffix if AWS_USE_FIPS_ENDPOINT=true is explicitly set
+        # Scenario 1: Standard GovCloud → bedrock.us-gov-east-1.amazonaws.com (boto3 default)
+        # Scenario 2: FIPS required → bedrock-fips.us-gov-east-1.amazonaws.com (explicit opt-in)
+        use_fips = os.environ.get("AWS_USE_FIPS_ENDPOINT", "").lower() == "true"
+
         if "gov" in aws_region:
-            # GovCloud regions use FIPS endpoints
-            detected_urls.append(f"https://bedrock-runtime-fips.{aws_region}.amazonaws.com")
+            # GovCloud regions
+            # Add both runtime (for LLM inference) and control plane (for model capability detection)
+            if use_fips:
+                # FIPS endpoints (only when explicitly requested via AWS_USE_FIPS_ENDPOINT=true)
+                detected_urls.append(f"https://bedrock-runtime-fips.{aws_region}.amazonaws.com")
+                detected_urls.append(f"https://bedrock-fips.{aws_region}.amazonaws.com")
+            else:
+                # Standard GovCloud endpoints (boto3 default behavior)
+                # This is what boto3 uses unless FIPS is explicitly configured
+                detected_urls.append(f"https://bedrock-runtime.{aws_region}.amazonaws.com")
+                detected_urls.append(f"https://bedrock.{aws_region}.amazonaws.com")
         elif "cn-" in aws_region:
-            # AWS China regions use .amazonaws.com.cn
+            # AWS China regions use .amazonaws.com.cn domain
             detected_urls.append(f"https://bedrock-runtime.{aws_region}.amazonaws.com.cn")
+            detected_urls.append(f"https://bedrock.{aws_region}.amazonaws.com.cn")
         else:
-            # Standard commercial regions
+            # Standard commercial regions (us-east-1, eu-west-1, etc.)
+            # Add both runtime (for LLM inference) and control plane (for model capability detection)
             detected_urls.append(f"https://bedrock-runtime.{aws_region}.amazonaws.com")
+            detected_urls.append(f"https://bedrock.{aws_region}.amazonaws.com")
 
     # Azure OpenAI: Extract from resource name if AZURE_OPENAI_KEY is set
     azure_key = os.environ.get("AZURE_OPENAI_KEY") or os.environ.get("AZURE_API_KEY")
@@ -276,9 +308,28 @@ fi
 # Configure iptables
 echo "Configuring firewall rules..."
 
-# Allow DNS (required for hostname resolution)
-iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
-iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
+# Extract DNS resolver IP(s) from /etc/resolv.conf
+# This locks DNS queries to only the container's configured resolver,
+# preventing agents from directly querying attacker-controlled DNS servers
+RESOLVER_IPS=$(grep '^nameserver' /etc/resolv.conf | awk '{print $2}')
+
+if [ -z "$RESOLVER_IPS" ]; then
+    echo "❌ ERROR: Could not detect DNS resolver from /etc/resolv.conf"
+    echo "Cannot configure secure DNS filtering without a resolver"
+    exit 1
+fi
+
+# Allow DNS ONLY to detected resolver IPs (SECURITY FIX)
+# This prevents the OpenAI-style DNS tunneling attack where agents
+# send DNS packets directly to attacker-controlled DNS servers
+echo "Locking DNS queries to container's resolver(s):"
+while IFS= read -r RESOLVER_IP; do
+    if [ -n "$RESOLVER_IP" ]; then
+        echo "  $RESOLVER_IP (DNS)"
+        iptables -A OUTPUT -d $RESOLVER_IP -p udp --dport 53 -j ACCEPT
+        iptables -A OUTPUT -d $RESOLVER_IP -p tcp --dport 53 -j ACCEPT
+    fi
+done <<< "$RESOLVER_IPS"
 
 # Allow localhost
 iptables -A OUTPUT -d 127.0.0.1/8 -j ACCEPT

{patchpal-0.24.1 → patchpal-0.24.2/patchpal.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: patchpal
-Version: 0.24.1
+Version: 0.24.2
 Summary: An agentic coding and automation assistant, supporting both local and cloud LLMs
 Author: PatchPal Contributors
 License-Expression: Apache-2.0