PatchWing turns a known CVE into a verified, mergeable patch
An open-source pipeline reproduces the flaw, writes the fix, and proves it in a re-runnable bundle — plus a way to stop agents faking their test data.
Copy markdown
Six stages, from bug report to proof
The pipeline runs ingest → localize → reproduce (build a test that fails on the unpatched code, then freeze it) → patch (a minimal fix plus regression tests) → verify (apply in a sandbox, run the full suite, then roll back to prove the bug returns) → package. It's language-agnostic; the repo ships worked runs on an npm Zip-Slip, a libxml2 C flaw, and a Vite fs.deny bypass.
Bring your own model, about $1.28 a fix
Three configurable roles — fixer, verifier, provision — point at any OpenAI-compatible endpoint: vLLM, Ollama, llama.cpp, Together or a commercial API, with keys read from env, not config. The project clocks one full CVE closure at roughly $1.28 on hosted inference, so your own coding model can drive a real, auditable patch workflow.
The evidence bundle is the deliverable
Every run ships an offline, re-runnable container: a hash-triple rollback proof (before → after → reverted), a SHA256-frozen reproducer, and a four-state verdict (confirmed_red/green, different_bug, harness_fault). The output isn't a patch you hope works — it's one a maintainer can re-verify without re-deriving it.
Read the fine print before you trust it
It's early: single-operator, an unhardened admin surface, and no upstream PRs submitted yet. The verifier shares a model family with the fixer — stamped 'weak independence' on every bundle — and it proves the frozen reproducer plus a green suite, not global semantic correctness. Treat bundles as evidence for review, not a merge button.
Elsewhere: stop your agent inventing its test data
Datamimic (pip install datamimic-ce, MIT) gives coding agents deterministic, domain-aware synthetic data through an MCP adapter — same engine, model and seed yields byte-identical output every run. It covers finance, healthcare, insurance and more, so an agent can self-serve realistic fixtures instead of hallucinating a test world.