patchpal 0.24.6__tar.gz → 0.25.1__tar.gz

{patchpal-0.24.6/patchpal.egg-info → patchpal-0.25.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: patchpal
-Version: 0.24.6
+Version: 0.25.1
 Summary: An agentic coding and automation assistant, supporting both local and cloud LLMs
 Author: PatchPal Contributors
 License-Expression: Apache-2.0

{patchpal-0.24.6 → patchpal-0.25.1}/patchpal/__init__.py

@@ -1,6 +1,6 @@
 """PatchPal - An open-source Claude Code clone implemented purely in Python."""
 
-__version__ = "0.24.6"
+__version__ = "0.25.1"
 
 from patchpal.agent import create_agent, create_react_agent
 from patchpal.cli.autopilot import autopilot_loop

{patchpal-0.24.6 → patchpal-0.25.1}/patchpal/agent/function_calling.py

@@ -1358,13 +1358,36 @@ Repository root takes priority if both exist."""
                         print(f"\033[1;31m✗ {tool_name}: Invalid arguments\033[0m\n", flush=True)
                     else:
                         # Get the tool function (check custom tools first, then built-in)
-                        tool_func = self.custom_tool_funcs.get(tool_name) or TOOL_FUNCTIONS.get(
-                            tool_name
-                        )
-                        if tool_func is None:
+                        tool_func = self.custom_tool_funcs.get(tool_name)
+                        tool_disabled = False  # Track if tool was disabled
+
+                        # If not a custom tool, check built-in tools with enabled_tools filter
+                        if tool_func is None and tool_name in TOOL_FUNCTIONS:
+                            # Only execute built-in tool if it's enabled
+                            # (enabled_tools=None means all enabled, otherwise check the list)
+                            if self.enabled_tools is None or tool_name in self.enabled_tools:
+                                tool_func = TOOL_FUNCTIONS.get(tool_name)
+                            else:
+                                # Tool is not enabled - reject with clear error
+                                tool_disabled = True
+                                available = (
+                                    ", ".join(self.enabled_tools)
+                                    if self.enabled_tools
+                                    else "none (custom tools only)"
+                                )
+                                tool_result = f"Error: Tool '{tool_name}' is not enabled. Available built-in tools: {available}"
+                                print(
+                                    f"\033[1;31m✗ {tool_name}: Tool not enabled\033[0m\n",
+                                    flush=True,
+                                )
+
+                        # Only mark as unknown if tool wasn't found AND wasn't disabled
+                        if tool_func is None and not tool_disabled:
                             tool_result = f"Error: Unknown tool {tool_name}"
                             print(f"\033[1;31m✗ Unknown tool: {tool_name}\033[0m\n", flush=True)
-                        else:
+
+                        # Only execute if we have a function and tool wasn't disabled
+                        if tool_func is not None and not tool_disabled:
                             # Show tool call message
                             if tool_name in self.custom_tool_funcs:
                                 # Custom tool - show generic message with args

{patchpal-0.24.6 → patchpal-0.25.1}/patchpal/cli/sandbox.py

@@ -106,6 +106,13 @@ def is_interactive_command(patchpal_args):
             return False
 
     # Check for autopilot
+    # NOTE: Only patchpal_args[0] is checked (not a scan of the whole list) by
+    # design. The "--" convention guarantees everything after it is passed to
+    # patchpal, and the autopilot subcommand, when present, is always the first
+    # of those args (e.g. `... -- autopilot --prompt-file task.md`). A later
+    # occurrence of the word "autopilot" would be a value/argument, not the
+    # subcommand, so it must not flip interactivity. Do not "fix" this into a
+    # full-list scan.
     if patchpal_args[0] in ["autopilot", "patchpal-autopilot"]:
         return False
 
@@ -124,6 +131,9 @@ def detect_llm_endpoints_from_env():
     standard_endpoints = {
         "OPENAI_API_KEY": "https://api.openai.com",
         "ANTHROPIC_API_KEY": "https://api.anthropic.com",
+        # Google Gemini: LiteLLM commonly uses GEMINI_API_KEY; GOOGLE_API_KEY is
+        # also supported. Both map to the same generative language endpoint.
+        "GEMINI_API_KEY": "https://generativelanguage.googleapis.com",
         "GOOGLE_API_KEY": "https://generativelanguage.googleapis.com",
         "GROQ_API_KEY": "https://api.groq.com",
         "COHERE_API_KEY": "https://api.cohere.ai",
@@ -574,6 +584,14 @@ def build_container_args(sandbox_args, patchpal_args, env_file_keys=None):
     if sandbox_args.cpus:
         container_args.extend(["--cpus", str(sandbox_args.cpus)])
 
+    # Forward user-specified volume mounts (-v/--volume) and environment
+    # variables (-e/--env). These are passed through verbatim to the container
+    # runtime, mirroring docker/podman's own -v and -e semantics.
+    for volume in getattr(sandbox_args, "volume", []) or []:
+        container_args.extend(["-v", volume])
+    for env_var in getattr(sandbox_args, "env", []) or []:
+        container_args.extend(["-e", env_var])
+
     # Pass through environment variables.
     # WITHOUT --env-file: pass through matching vars from the full host environment.
     # WITH --env-file: isolate from the host, but still forward the vars that were
@@ -788,14 +806,48 @@ def build_container_args(sandbox_args, patchpal_args, env_file_keys=None):
 
     # Add main patchpal command
     if sandbox_args.restrict_network:
-        # Use launch-agent-sandbox pattern: model from env var
-        # Falls back to PATCHPAL_MODEL if MODEL not set
+        # Pass through all patchpal args via "$@" (identical to normal mode) so that
+        # the autopilot subcommand and flags like --prompt-file / --max-iterations are
+        # preserved. The model is included in "$@" when --model was given on the command
+        # line. If no --model was provided, fall back to the MODEL/PATCHPAL_MODEL env var
+        # (launch-agent-sandbox pattern).
+        #
+        # SECURITY: Drop CAP_NET_ADMIN / CAP_NET_RAW before handing control to the
+        # agent. The container runs as root (UID 0) and keeps the capability that
+        # was used to build the iptables firewall. Without dropping it, an agent
+        # that can execute shell commands could simply run `iptables -F OUTPUT`
+        # (or `iptables -P OUTPUT ACCEPT`) and dismantle the very network
+        # restrictions that --restrict-network is supposed to enforce.
+        #
+        # We drop the capabilities from BOTH the inheritable and bounding sets via
+        # setpriv. For a root process this also clears them from the effective and
+        # permitted sets, and removing them from the bounding set means they cannot
+        # be re-raised afterwards. The firewall rules remain in force, but the
+        # agent process can no longer modify netfilter. (setpriv ships with
+        # util-linux and is present in the sandbox image; if it is somehow missing
+        # we fall back to a plain exec and warn loudly.)
+        if model_arg:
+            # --model is already present in the pass-through args
+            model_display = model_arg
+            run_cmd = f'{patchpal_cmd} "$@"'
+        else:
+            # No --model on command line; supply it from the env var fallback
+            model_display = "${MODEL:-$PATCHPAL_MODEL}"
+            run_cmd = f'{patchpal_cmd} --model "${{MODEL:-$PATCHPAL_MODEL}}" "$@"'
         shell_cmd_parts.append(f"""
 echo ""
 echo "=== Starting PatchPal ==="
-echo "Model: ${{MODEL:-$PATCHPAL_MODEL}}"
+echo "Model: {model_display}"
 echo ""
-exec {patchpal_cmd} --model "${{MODEL:-$PATCHPAL_MODEL}}"
+if command -v setpriv >/dev/null 2>&1; then
+    echo "Dropping CAP_NET_ADMIN/CAP_NET_RAW before starting agent (firewall now tamper-resistant)"
+    exec setpriv --inh-caps -net_admin,-net_raw --bounding-set -net_admin,-net_raw \\
+        {run_cmd}
+else
+    echo "⚠️  WARNING: setpriv not found - cannot drop network capabilities."
+    echo "⚠️  The agent runs as root and could tamper with the iptables firewall."
+    exec {run_cmd}
+fi
 """)
     else:
         # Normal mode: use $@ to pass all arguments
@@ -813,13 +865,9 @@ exec {patchpal_cmd} "$@"
     # Add set -e at the beginning to exit on any error
     shell_cmd = "set -e\n" + "\n".join(shell_cmd_parts)
 
-    # Pass arguments differently based on network restrictions
-    if sandbox_args.restrict_network:
-        # With restrictions: model passed as env var, no additional args needed
-        container_args.extend(["bash", "-c", shell_cmd])
-    else:
-        # Without restrictions: pass args after -- separator
-        container_args.extend(["bash", "-c", shell_cmd, "--"] + patchpal_cmd_args)
+    # Pass patchpal args after the "--" separator so they populate "$@" in the
+    # bash script. This applies to both restricted and unrestricted modes.
+    container_args.extend(["bash", "-c", shell_cmd, "--"] + patchpal_cmd_args)
 
     return container_args, runtime
 
@@ -853,14 +901,20 @@ SCRIPT OPTIONS:
     --host-network      Use host network (for local Ollama/vLLM servers on localhost)
     --memory LIMIT      Memory limit (e.g., 2g, 4g) - optional, no limit by default
     --cpus NUM          CPU limit (e.g., 2, 4) - optional, no limit by default
-    --env-file FILE     Load environment variables from .env file
+    --env-file FILE     Load environment variables from .env file (single file)
+    -v, --volume HOST:CONTAINER[:ro]
+                        Mount an additional volume (can be specified multiple times)
+                        Example: -v /path/to/data:/data:ro
+    -e, --env KEY=VALUE Pass an additional environment variable into the container
+                        (can be specified multiple times)
+                        Example: -e MY_VAR=value
     --restrict-network  Enable iptables firewall for network isolation
                         Automatically detects LLM endpoints from environment variables:
                         * OpenAI (OPENAI_API_KEY)
                         * Anthropic (ANTHROPIC_API_KEY)
                         * AWS Bedrock (AWS_REGION + AWS_ACCESS_KEY_ID)
                         * Azure OpenAI (AZURE_OPENAI_KEY + AZURE_OPENAI_RESOURCE)
-                        * Google AI (GOOGLE_API_KEY)
+                        * Google AI (GEMINI_API_KEY or GOOGLE_API_KEY)
                         * Groq, Cohere, Together, Replicate, etc.
                         Custom endpoints also detected from *_BASE_URL env vars
     --allow-url URL     Allow network access to specific URL (can be specified multiple times)
@@ -1126,6 +1180,24 @@ def main():
         action="store_true",
         help="Drop into bash shell instead of running patchpal (for debugging)",
     )
+    parser.add_argument(
+        "-v",
+        "--volume",
+        action="append",
+        default=[],
+        metavar="HOST:CONTAINER[:ro]",
+        help="Mount an additional volume into the container (can be specified multiple times). "
+        "Example: -v /path/to/data:/data:ro",
+    )
+    parser.add_argument(
+        "-e",
+        "--env",
+        action="append",
+        default=[],
+        metavar="KEY=VALUE",
+        help="Pass an additional environment variable into the container "
+        "(can be specified multiple times). Example: -e MY_VAR=value",
+    )
 
     try:
         sandbox_args = parser.parse_args(sandbox_argv)

{patchpal-0.24.6 → patchpal-0.25.1/patchpal.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: patchpal
-Version: 0.24.6
+Version: 0.25.1
 Summary: An agentic coding and automation assistant, supporting both local and cloud LLMs
 Author: PatchPal Contributors
 License-Expression: Apache-2.0

{patchpal-0.24.6 → patchpal-0.25.1}/tests/test_enabled_tools.py

@@ -162,5 +162,91 @@ def test_env_var_with_spaces():
         del os.environ["PATCHPAL_ENABLED_TOOLS"]
 
 
+def test_disabled_tool_execution_is_blocked(monkeypatch):
+    """Test that disabled tools cannot be executed even if LLM tries to call them.
+
+    This is a regression test for the bug where enabled_tools only filtered
+    the tool schemas sent to the LLM, but didn't prevent execution if the LLM
+    hallucinated a call to a disabled tool.
+    """
+    # Disable streaming for simpler mocking. monkeypatch auto-restores the
+    # env var on teardown, so this won't pollute other tests.
+    monkeypatch.setenv("PATCHPAL_STREAM_OUTPUT", "false")
+
+    with patch("patchpal.agent.function_calling.litellm.completion") as mock_completion:
+        # Create a mock tool call for run_shell (which is NOT enabled)
+        mock_tool_call = MagicMock()
+        mock_tool_call.id = "call_123"
+        mock_tool_call.function.name = "run_shell"
+        mock_tool_call.function.arguments = '{"cmd": "echo test"}'
+
+        # First call: LLM tries to call run_shell (not enabled)
+        mock_response1 = MagicMock()
+        mock_response1.choices = [MagicMock()]
+        mock_response1.choices[0].message.content = "Running command"
+        mock_response1.choices[0].message.tool_calls = [mock_tool_call]
+        mock_response1.usage = MagicMock(
+            prompt_tokens=10,
+            completion_tokens=5,
+            cache_creation_input_tokens=0,
+            cache_read_input_tokens=0,
+        )
+
+        # Second call: LLM responds after seeing the error
+        mock_response2 = MagicMock()
+        mock_response2.choices = [MagicMock()]
+        mock_response2.choices[0].message.content = "Tool not available"
+        mock_response2.choices[0].message.tool_calls = None
+        mock_response2.usage = MagicMock(
+            prompt_tokens=10,
+            completion_tokens=5,
+            cache_creation_input_tokens=0,
+            cache_read_input_tokens=0,
+        )
+
+        mock_completion.side_effect = [mock_response1, mock_response2]
+
+        # Create agent with only read_file enabled (run_shell is NOT enabled)
+        agent = create_agent(enabled_tools=["read_file"])
+
+        # Run - should reject run_shell execution
+        agent.run("Test message")
+
+        # Verify run_shell was blocked (check the agent's message history)
+        tool_results = [msg for msg in agent.messages if msg.get("role") == "tool"]
+        assert len(tool_results) == 1, f"Expected 1 tool result, got {len(tool_results)}"
+
+        # The tool result should contain an error about the tool not being enabled
+        error_message = tool_results[0]["content"]
+        assert "not enabled" in error_message
+        assert "run_shell" in error_message
+
+
+def test_enabled_tool_execution_is_allowed():
+    """Test that enabled tools CAN be executed when LLM calls them."""
+    # This is a simple verification that enabled tools work - detailed behavior
+    # is tested in integration tests
+    agent = create_agent(enabled_tools=["read_file", "write_file"])
+
+    # Just verify the agent was created with correct enabled_tools
+    assert agent.enabled_tools == ["read_file", "write_file"]
+    assert len(agent.custom_tools) == 0
+
+
+def test_empty_enabled_tools_blocks_all_builtins():
+    """Test that enabled_tools=[] blocks all built-in tools (only custom tools allowed)."""
+
+    def custom_tool(x: int) -> str:
+        """A custom tool."""
+        return f"Result: {x}"
+
+    agent = create_agent(enabled_tools=[], custom_tools=[custom_tool])
+
+    # Verify configuration
+    assert agent.enabled_tools == []
+    assert len(agent.custom_tools) == 1
+    assert agent.custom_tools[0].__name__ == "custom_tool"
+
+
 if __name__ == "__main__":
     pytest.main([__file__, "-v"])