patchpal 0.24.6__tar.gz → 0.25.0__tar.gz

{patchpal-0.24.6/patchpal.egg-info → patchpal-0.25.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: patchpal
-Version: 0.24.6
+Version: 0.25.0
 Summary: An agentic coding and automation assistant, supporting both local and cloud LLMs
 Author: PatchPal Contributors
 License-Expression: Apache-2.0

{patchpal-0.24.6 → patchpal-0.25.0}/patchpal/__init__.py

@@ -1,6 +1,6 @@
 """PatchPal - An open-source Claude Code clone implemented purely in Python."""
 
-__version__ = "0.24.6"
+__version__ = "0.25.0"
 
 from patchpal.agent import create_agent, create_react_agent
 from patchpal.cli.autopilot import autopilot_loop

{patchpal-0.24.6 → patchpal-0.25.0}/patchpal/agent/function_calling.py

@@ -1358,13 +1358,36 @@ Repository root takes priority if both exist."""
                         print(f"\033[1;31m✗ {tool_name}: Invalid arguments\033[0m\n", flush=True)
                     else:
                         # Get the tool function (check custom tools first, then built-in)
-                        tool_func = self.custom_tool_funcs.get(tool_name) or TOOL_FUNCTIONS.get(
-                            tool_name
-                        )
-                        if tool_func is None:
+                        tool_func = self.custom_tool_funcs.get(tool_name)
+                        tool_disabled = False  # Track if tool was disabled
+
+                        # If not a custom tool, check built-in tools with enabled_tools filter
+                        if tool_func is None and tool_name in TOOL_FUNCTIONS:
+                            # Only execute built-in tool if it's enabled
+                            # (enabled_tools=None means all enabled, otherwise check the list)
+                            if self.enabled_tools is None or tool_name in self.enabled_tools:
+                                tool_func = TOOL_FUNCTIONS.get(tool_name)
+                            else:
+                                # Tool is not enabled - reject with clear error
+                                tool_disabled = True
+                                available = (
+                                    ", ".join(self.enabled_tools)
+                                    if self.enabled_tools
+                                    else "none (custom tools only)"
+                                )
+                                tool_result = f"Error: Tool '{tool_name}' is not enabled. Available built-in tools: {available}"
+                                print(
+                                    f"\033[1;31m✗ {tool_name}: Tool not enabled\033[0m\n",
+                                    flush=True,
+                                )
+
+                        # Only mark as unknown if tool wasn't found AND wasn't disabled
+                        if tool_func is None and not tool_disabled:
                             tool_result = f"Error: Unknown tool {tool_name}"
                             print(f"\033[1;31m✗ Unknown tool: {tool_name}\033[0m\n", flush=True)
-                        else:
+
+                        # Only execute if we have a function and tool wasn't disabled
+                        if tool_func is not None and not tool_disabled:
                             # Show tool call message
                             if tool_name in self.custom_tool_funcs:
                                 # Custom tool - show generic message with args

{patchpal-0.24.6 → patchpal-0.25.0/patchpal.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: patchpal
-Version: 0.24.6
+Version: 0.25.0
 Summary: An agentic coding and automation assistant, supporting both local and cloud LLMs
 Author: PatchPal Contributors
 License-Expression: Apache-2.0

{patchpal-0.24.6 → patchpal-0.25.0}/tests/test_enabled_tools.py

@@ -162,5 +162,91 @@ def test_env_var_with_spaces():
         del os.environ["PATCHPAL_ENABLED_TOOLS"]
 
 
+def test_disabled_tool_execution_is_blocked(monkeypatch):
+    """Test that disabled tools cannot be executed even if LLM tries to call them.
+
+    This is a regression test for the bug where enabled_tools only filtered
+    the tool schemas sent to the LLM, but didn't prevent execution if the LLM
+    hallucinated a call to a disabled tool.
+    """
+    # Disable streaming for simpler mocking. monkeypatch auto-restores the
+    # env var on teardown, so this won't pollute other tests.
+    monkeypatch.setenv("PATCHPAL_STREAM_OUTPUT", "false")
+
+    with patch("patchpal.agent.function_calling.litellm.completion") as mock_completion:
+        # Create a mock tool call for run_shell (which is NOT enabled)
+        mock_tool_call = MagicMock()
+        mock_tool_call.id = "call_123"
+        mock_tool_call.function.name = "run_shell"
+        mock_tool_call.function.arguments = '{"cmd": "echo test"}'
+
+        # First call: LLM tries to call run_shell (not enabled)
+        mock_response1 = MagicMock()
+        mock_response1.choices = [MagicMock()]
+        mock_response1.choices[0].message.content = "Running command"
+        mock_response1.choices[0].message.tool_calls = [mock_tool_call]
+        mock_response1.usage = MagicMock(
+            prompt_tokens=10,
+            completion_tokens=5,
+            cache_creation_input_tokens=0,
+            cache_read_input_tokens=0,
+        )
+
+        # Second call: LLM responds after seeing the error
+        mock_response2 = MagicMock()
+        mock_response2.choices = [MagicMock()]
+        mock_response2.choices[0].message.content = "Tool not available"
+        mock_response2.choices[0].message.tool_calls = None
+        mock_response2.usage = MagicMock(
+            prompt_tokens=10,
+            completion_tokens=5,
+            cache_creation_input_tokens=0,
+            cache_read_input_tokens=0,
+        )
+
+        mock_completion.side_effect = [mock_response1, mock_response2]
+
+        # Create agent with only read_file enabled (run_shell is NOT enabled)
+        agent = create_agent(enabled_tools=["read_file"])
+
+        # Run - should reject run_shell execution
+        agent.run("Test message")
+
+        # Verify run_shell was blocked (check the agent's message history)
+        tool_results = [msg for msg in agent.messages if msg.get("role") == "tool"]
+        assert len(tool_results) == 1, f"Expected 1 tool result, got {len(tool_results)}"
+
+        # The tool result should contain an error about the tool not being enabled
+        error_message = tool_results[0]["content"]
+        assert "not enabled" in error_message
+        assert "run_shell" in error_message
+
+
+def test_enabled_tool_execution_is_allowed():
+    """Test that enabled tools CAN be executed when LLM calls them."""
+    # This is a simple verification that enabled tools work - detailed behavior
+    # is tested in integration tests
+    agent = create_agent(enabled_tools=["read_file", "write_file"])
+
+    # Just verify the agent was created with correct enabled_tools
+    assert agent.enabled_tools == ["read_file", "write_file"]
+    assert len(agent.custom_tools) == 0
+
+
+def test_empty_enabled_tools_blocks_all_builtins():
+    """Test that enabled_tools=[] blocks all built-in tools (only custom tools allowed)."""
+
+    def custom_tool(x: int) -> str:
+        """A custom tool."""
+        return f"Result: {x}"
+
+    agent = create_agent(enabled_tools=[], custom_tools=[custom_tool])
+
+    # Verify configuration
+    assert agent.enabled_tools == []
+    assert len(agent.custom_tools) == 1
+    assert agent.custom_tools[0].__name__ == "custom_tool"
+
+
 if __name__ == "__main__":
     pytest.main([__file__, "-v"])