agentic-dev-loop 0.10.2__py3-none-any.whl → 0.10.3__py3-none-any.whl

agentic_dev_loop/engine/forbidden.py

@@ -1,4 +1,4 @@
-"""Banned-command deny-list (036 D1).
+"""Banned-command deny-list (036 D1, revised by 056).
 
 The sandbox terminal enforces a deny-list before any shell spawn: a command
 whose argv matches a step's ``forbidden_commands:`` regex (merged with the
@@ -6,11 +6,15 @@ engine defaults) returns a structured observation instead of reaching the
 sandbox. Command steps are unaffected - they are declared infrastructure and
 already fail fast on their exit code.
 
+The defaults are run invariants only: git mutations and docker.
+Tool-specific rules are not engine defaults - a step declares them with
+``forbidden_commands`` (the bundled onboarding recipes carry the engine's
+own toolchain guidance). The deny-list is network-independent by design;
+network is a sandbox egress concern.
+
 The default list carries human-readable labels; custom entries use their
-regex text as the label. ``dotnet restore`` and ``dotnet add`` are network
-gated: denied only while the step's ``network:`` flag is off.
+regex text as the label.
 """
-
 from __future__ import annotations
 
 import re
@@ -30,22 +34,9 @@ _DEFAULT_PATTERNS: tuple[tuple[str, str], ...] = (
     ("git checkout", r"\bgit\s+checkout\b"),
     ("git reset", r"\bgit\s+reset\b"),
     ("git tag", r"\bgit\s+tag\b"),
-    ("npm install", r"\bnpm\s+install\b"),
-    ("npm ci", r"\bnpm\s+ci\b"),
-    ("pip install", r"\bpip\s+install\b"),
-    ("uv add", r"\buv\s+add\b"),
-    ("pip-compile", r"\bpip-compile\b"),
-    ("dotnet add package", r"\bdotnet\s+add\s+package\b"),
-    ("npx playwright", r"\bnpx\s+playwright\b"),
-    ("playwright", r"\bplaywright\b"),
     ("docker", r"\bdocker\b"),
 )
 
-_NETWORK_GATED_PATTERNS: tuple[tuple[str, str], ...] = (
-    ("dotnet restore", r"\bdotnet\s+restore\b"),
-    ("dotnet add", r"\bdotnet\s+add\b"),
-)
-
 
 def _compile(label: str, pattern: str) -> ForbiddenRule:
     return ForbiddenRule(label=label, regex=re.compile(pattern, re.IGNORECASE))
@@ -54,21 +45,16 @@ def _compile(label: str, pattern: str) -> ForbiddenRule:
 DEFAULT_FORBIDDEN_RULES: tuple[ForbiddenRule, ...] = tuple(
     _compile(label, pattern) for label, pattern in _DEFAULT_PATTERNS)
 
-NETWORK_GATED_FORBIDDEN_RULES: tuple[ForbiddenRule, ...] = tuple(
-    _compile(label, pattern) for label, pattern in _NETWORK_GATED_PATTERNS)
-
 
-def resolve_forbidden_rules(custom_patterns: list[str] | tuple[str, ...] | None,
-                            network: bool) -> tuple[ForbiddenRule, ...]:
+def resolve_forbidden_rules(
+        custom_patterns: list[str] | tuple[str, ...] | None,
+) -> tuple[ForbiddenRule, ...]:
     """Merge the engine defaults with a step's custom regex list.
 
     Custom entries are appended after the defaults, so the first match wins
-    on overlap. Network-gated defaults are included only while ``network`` is
-    off; there is no disable escape hatch for the engine defaults.
+    on overlap; there is no disable escape hatch for the engine defaults.
     """
     rules = list(DEFAULT_FORBIDDEN_RULES)
-    if not network:
-        rules.extend(NETWORK_GATED_FORBIDDEN_RULES)
     for pattern in custom_patterns or ():
         rules.append(_compile(pattern, pattern))
     return tuple(rules)

agentic_dev_loop/engine/onboarding/recipes/dotnet-node.yaml

@@ -14,7 +14,18 @@ dev_impossible_set:
   - "database-category tests"
   - "commands that boot servers or need external services"
 steps:
-  - {name: brief, kind: brief, brief_inputs: {include: [AGENTS.md]}, on_pass: dev}
+  - name: brief
+    kind: brief
+    brief_inputs: {include: [AGENTS.md]}
+    forbidden_commands:
+      - npm install
+      - npm ci
+      - dotnet add package
+      - dotnet restore
+      - dotnet add
+      - npx playwright
+      - playwright
+    on_pass: dev
   - name: dev
     kind: agent
     agent: dev
@@ -22,6 +33,14 @@ steps:
     max_iterations: 100
     finalize_nudge_turns: 10
     produces: implementation-summary.md
+    forbidden_commands:
+      - npm install
+      - npm ci
+      - dotnet add package
+      - dotnet restore
+      - dotnet add
+      - npx playwright
+      - playwright
     setup: 'cd __FRONTEND_DIR__ && npm ci && cd .. && dotnet restore __SOLUTION__'
     mounts: [{path: ".", mode: rw}]
     on_pass: restore
@@ -62,9 +81,23 @@ steps:
     optional: {detect: tools/run-conformance.sh}
     on_pass: review
     on_fail: {goto: dev, retry: true}
-  - {name: review, kind: agent, agent: review, reasoning_effort: xhigh,
-     artifact: review-findings.md, verdicts: {pass: APPROVED, fail: NEEDS CHANGES},
-     mounts: [{path: ".", mode: ro}], on_pass: qa, on_fail: {goto: dev, retry: true}}
+  - name: review
+    kind: agent
+    agent: review
+    reasoning_effort: xhigh
+    artifact: review-findings.md
+    verdicts: {pass: APPROVED, fail: NEEDS CHANGES}
+    mounts: [{path: ".", mode: ro}]
+    forbidden_commands:
+      - npm install
+      - npm ci
+      - dotnet add package
+      - dotnet restore
+      - dotnet add
+      - npx playwright
+      - playwright
+    on_pass: qa
+    on_fail: {goto: dev, retry: true}
   - name: qa
     kind: agent
     agent: qa

agentic_dev_loop/engine/onboarding/recipes/python.yaml

@@ -11,7 +11,14 @@ brief_env_facts:
 dev_impossible_set:
   - "package-manager fetches after a new pin run only in the network-on restore step"
 steps:
-  - {name: brief, kind: brief, brief_inputs: {include: [AGENTS.md]}, on_pass: dev}
+  - name: brief
+    kind: brief
+    brief_inputs: {include: [AGENTS.md]}
+    forbidden_commands:
+      - pip install
+      - uv add
+      - pip-compile
+    on_pass: dev
   - name: dev
     kind: agent
     agent: dev
@@ -19,6 +26,10 @@ steps:
     max_iterations: 150
     finalize_nudge_turns: 10
     produces: implementation-summary.md
+    forbidden_commands:
+      - pip install
+      - uv add
+      - pip-compile
     setup: 'python -m venv __VENV__ && __VENV__/bin/pip install -e "__DEV_EXTRAS__"'
     mounts: [{path: ".", mode: rw}]
     on_pass: restore
@@ -38,9 +49,19 @@ steps:
     mounts: [{path: ".", mode: rw}]
     on_pass: review
     on_fail: {goto: dev, retry: true}
-  - {name: review, kind: agent, agent: review, reasoning_effort: xhigh,
-     artifact: review-findings.md, verdicts: {pass: APPROVED, fail: NEEDS CHANGES},
-     mounts: [{path: ".", mode: ro}], on_pass: qa, on_fail: {goto: dev, retry: true}}
+  - name: review
+    kind: agent
+    agent: review
+    reasoning_effort: xhigh
+    artifact: review-findings.md
+    verdicts: {pass: APPROVED, fail: NEEDS CHANGES}
+    mounts: [{path: ".", mode: ro}]
+    forbidden_commands:
+      - pip install
+      - uv add
+      - pip-compile
+    on_pass: qa
+    on_fail: {goto: dev, retry: true}
   - name: qa
     kind: agent
     agent: qa

agentic_dev_loop/engine/stages.py

@@ -158,8 +158,7 @@ class Runtime:
                 else:
                     cwd, mount_set, egress_policy = (self.workspace, None, None)
                 forbidden_commands = (
-                    resolve_forbidden_rules(step.forbidden_commands,
-                                            step.network)
+                    resolve_forbidden_rules(step.forbidden_commands)
                     if step is not None else None)
                 allowlist = (
                     tuple(self.engine_allowlist)

{agentic_dev_loop-0.10.2.dist-info → agentic_dev_loop-0.10.3.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentic-dev-loop
-Version: 0.10.2
+Version: 0.10.3
 Summary: Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase.
 Author: Luke Wilson
 License-Expression: Apache-2.0
@@ -229,6 +229,7 @@ steps:
     agent: dev
     produces: implementation-summary.md
     terminal_timeout: 900
+    # forbidden_commands: ["npm install", "npm ci"]      # per-step tool deny-list; engine defaults are git mutations + docker
     on_pass: test
 
   - name: test
@@ -268,6 +269,7 @@ steps:
 | `brief_inputs:` | The discriminator for a native brief step: `{ include: [<paths/globs>], env_facts: [<strings>], sections: [<headings>] }`. There is no `agent:`, `produces:`, or `max_iterations:` - the prompt is engine-embedded, the capture file is `attempt-brief.md`, and the iteration cap is 12, all engine-owned. The engine resolves the include list against the workspace, passes the resolved docs + include contents + env facts as the step's task message, and regenerates the step only when those inputs change. `sections` is the ordered list of digest headings the brief must emit (default `[Repo rules digest, Unit scope digest, Environment facts, Open risks]`; non-empty and unique). `name` stays free-form, so multiple brief steps are allowed. |
 | `terminal_timeout:` | Optional agent-step per-action timeout in seconds (gt 0). `SandboxTerminalExecutor` uses it when the agent leaves the terminal action timeout unset, overriding the SDK tool's default. `None` = current behavior. |
 | `finalize_nudge_turns:` | Optional agent-step final-response nudge (gt 0). Requires `max_iterations:` and must be less than it. At `max_iterations - finalize_nudge_turns` completed turns the engine injects one advisory turn ("`N turns remain: produce your final response now`"), exactly once; the agent may still exhaust its turns and existing stuck/unclear handling applies unchanged. Absent = current behavior. Provisional pending one consumer run (revert if noisy or the raised cap inflates cost). |
+| `forbidden_commands:` | Optional per-step list of regex patterns. The sandbox terminal matches them against each agent command before any shell spawn; a match returns a structured `[forbidden: <label>]` observation instead of running. A single string is coerced to a one-item list; an invalid regex fails at load. Defaults are run invariants only (git mutations, docker); tool-specific rules belong to the toolchain profile/recipe or the pipeline author. Command steps are unaffected. See [Banned commands](#banned-commands-forbidden_commands). |
 | `custom_prompt:` | Planned (planning-docs/040). Optional agent-step value: literal text, or a path whose file contents are read at load time, appended verbatim to the agent prompt at context assembly (after the prompt, before the task/artifacts). A value that looks like a path but names no file is a validation error. Agent steps only. |
 | `llms:` (top-level) / step `llm:` | Named LLM profiles, each a full `LlmConfig` (`model`, `base_url`, `api_key_env`, `timeout`, `reasoning_effort`). A step names one with `llm: <profile-name>`; the whole profile moves together (no partial merges). Allowed only on agent and brief steps. The top-level `llm:` block remains the default. Profile keys are host-side - sandbox access still goes through `secrets:`. |
 | `reasoning_effort:` | Optional `low` / `medium` / `high` / `xhigh` / `none`. Set on the `llm` block, a `llms:` profile, or per-step (a step value overrides the effective profile's). Unset anywhere = reasoning off: nothing is forwarded and reasoning is stripped from requests. A thinking model without an effort level is invalid config and fails at the first request (crap in, crap out). See [Reasoning effort](#reasoning-effort-opt-in). |
@@ -284,6 +286,22 @@ steps:
 | `caches:` / `sync_excludes:` | Top-level run-wide lists. `caches:` names repo-relative toolchain cache dirs bind-mounted rw from host-side stores under `{state_dir}/caches/<name>` (auto-created); a `setup:` hook can warm them (the provision container carries the same cache mounts); `sync_excludes:` names non-gitignored scratch paths skipped from both the export copy and sync-back (wildcard `*` spans separators, so `**/bin/**` matches a `/bin/` segment at any depth). Both default to `[]`. See [docs/setup.md](docs/setup.md). |
 | `merge_on_conflict:` | Top-level run-wide list of append-style logs (same path vocabulary as `sync_excludes:`, default `[]`). A concurrent host edit to a listed path is union-merged instead of raising: the host file wins and the sandbox's export-only lines are appended in order; both sides converge and the run continues. See [docs/setup.md](docs/setup.md). |
 
+### Banned commands (`forbidden_commands:`)
+
+`forbidden_commands:` is a per-step list of regex patterns. The sandbox
+terminal checks them against every command the agent runs, before any shell
+spawn: a match returns a structured `[forbidden: <label>]` observation instead
+of executing. The engine defaults are run invariants only - git mutations and
+docker - so the deny-list is network-independent by design: `network:` stays a
+docker/egress concern. A single string is coerced to a one-item list; an
+invalid regex is a load error. Command steps bypass the filter by design.
+
+Tool-specific rules are not engine defaults. A toolchain profile or bundled
+recipe declares them per step (for example the `python` recipe denies
+`pip install`, `uv add`, and `pip-compile` on its agent steps), and a
+consumer pipeline authors its own for its toolchain. There is no disable
+escape hatch for the engine defaults.
+
 ### Reasoning effort (opt-in)
 
 `reasoning_effort` is an opt-in latency dial on the pipeline `llm` block, a

{agentic_dev_loop-0.10.2.dist-info → agentic_dev_loop-0.10.3.dist-info}/RECORD

@@ -23,7 +23,7 @@ agentic_dev_loop/engine/deps.py,sha256=bxwEtn04koZhP5B6SmC7hzlpQqoCKoPg5UAUJf2sE
 agentic_dev_loop/engine/dryrun.py,sha256=KaEAtIiYF9AvVCGawesD8vP-XQkIF671ux_Q9DAZRc0,6876
 agentic_dev_loop/engine/egress_policy.py,sha256=Gon_S6arEMjRJOEcjr-iqZGKxxu5YQxMo5eYHgz0_zs,4676
 agentic_dev_loop/engine/egress_proxy.py,sha256=hZxyUzagYu8pkzk-IbzefRrRawfIMTMh_gRKNymrIbQ,13087
-agentic_dev_loop/engine/forbidden.py,sha256=Iz8q1LUil9bT8g3jC_JFmICIqsmDSbN2XcIYvxCw3Ew,3226
+agentic_dev_loop/engine/forbidden.py,sha256=_SoxtnJXsw7dDBxvms2Yv_3R2311jxNLzF72AFR-zfw,2642
 agentic_dev_loop/engine/graph.py,sha256=LzM8vkgZyMyibQLA0tA_0UkUQNsz3uW4H3RQ_MuyHDE,17181
 agentic_dev_loop/engine/hostboundary.py,sha256=kEDtCWQXSlMwmdPRL7C41rVV55dRLHWMfpcUOPoWb6c,5893
 agentic_dev_loop/engine/isolation.py,sha256=bRPch_xWrz3KSBZgZzpbB3WMh8qUu98LdHqq8rtpJEM,81887
@@ -35,7 +35,7 @@ agentic_dev_loop/engine/presets.py,sha256=Avo9Mb4YNyv4e5y7Ib0HptJ_S5srvTssdN-keT
 agentic_dev_loop/engine/proc.py,sha256=MU-tV1_MXm28NHKuNpSW8zm3U_pFCgQhd-yAVCXoUB0,2739
 agentic_dev_loop/engine/registry.py,sha256=qepez9iU-dBE-yG67qI7Q7Ol89NsERHy34eoQc98Ek0,14296
 agentic_dev_loop/engine/secrets.py,sha256=WCVyDk97AGvRkwxXw6tbgztHVZbtxJvJC23b4I1EeNY,4678
-agentic_dev_loop/engine/stages.py,sha256=TJEl-yQYIPEfDyWJ0c_QxWz4uVsZ0rc0xVJaPCzaz0I,56500
+agentic_dev_loop/engine/stages.py,sha256=ftImuf1WYpy0qJ22vsBB1bhy1qNIfw6lU9rBdDAhj_s,56442
 agentic_dev_loop/engine/step_workspace.py,sha256=YyaZWk8ozc_v7AFBt63QAn4VFL-a1wvhzNvnbascYYw,7937
 agentic_dev_loop/engine/sync_back.py,sha256=Mc6YAAhc_Iydz-7Ht3OkyGekaa6s1HitCsOlIepDfOc,13942
 agentic_dev_loop/engine/extensions/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -46,8 +46,8 @@ agentic_dev_loop/engine/onboarding/doctor.py,sha256=gSZxXU7AaS7DajlMppeEWReZm-2-
 agentic_dev_loop/engine/onboarding/init.py,sha256=aBIcFHbI_nLu_EjVksopdaZQja1aE6dtClW0xqko32g,15811
 agentic_dev_loop/engine/onboarding/recipes.py,sha256=s_SF87VjXyS7uOuPUg4i5UBFRL9Ad2plnw3UHfDeTFQ,2326
 agentic_dev_loop/engine/onboarding/templates.py,sha256=uE5hMjRKmyBxggr72MsS1ZjDMSBr61GoPdEaQNPERkE,2115
-agentic_dev_loop/engine/onboarding/recipes/dotnet-node.yaml,sha256=irwsKtVMT8c04TTEP5O0o1frYVBdGOQ5uSmhUkp2mhA,3214
-agentic_dev_loop/engine/onboarding/recipes/python.yaml,sha256=fXpzysCdZpjN3xGQ2wTLH9IIvxEOHyD3TKqPRlA-15k,2235
+agentic_dev_loop/engine/onboarding/recipes/dotnet-node.yaml,sha256=Uqq__RbPbZ3NuNtW04-CAdY-mARP3oQHzt2byTZMz_g,3743
+agentic_dev_loop/engine/onboarding/recipes/python.yaml,sha256=42nvggXaQ4rrPAlNjrYnLeD6czuwchYVRnrFziefRKA,2491
 agentic_dev_loop/engine/onboarding/templates/dev.agent.md,sha256=GdbENdOrWSJ8FKWqf97Z9JsjnEZuC9p0RHTNR6Cmuk8,6460
 agentic_dev_loop/engine/onboarding/templates/env.example,sha256=sM3ykvPfGNg_VAgaS4NwLdGjeX3Ow4UA_ZC_dRXV_1w,463
 agentic_dev_loop/engine/onboarding/templates/qa.agent.md,sha256=QE_z8ssefRRKXHI-ssvPW8Njv4OUycRDCfRaAUHIS5k,10045
@@ -58,9 +58,9 @@ agentic_dev_loop/engine/seccomp/chromium-userns.json,sha256=ahmqvWprLe_oG_oLXFMU
 agentic_dev_loop/viz/__init__.py,sha256=eoRfcUCC3-j7JhShft7Ruk8ruT5oFUoMKEKClO45B4I,520
 agentic_dev_loop/viz/__main__.py,sha256=baycB1QwQtM-B2bXo4Du5lwvItcMgJwJlAzsHACxM-4,1409
 agentic_dev_loop/viz/server.py,sha256=-7lHiBCBQx3h0g-TfQyIaWG1tIfrWrqfLJco1-4GJOI,47637
-agentic_dev_loop-0.10.2.dist-info/licenses/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
-agentic_dev_loop-0.10.2.dist-info/METADATA,sha256=ffXQiRJ-GUQl6KOBrNvxyfinphE-e_k8yo6fLooZXBU,44760
-agentic_dev_loop-0.10.2.dist-info/WHEEL,sha256=mOdXR9C3wMVov7cSY8PY-XCzo3SmmWCHvGQr5csJoao,91
-agentic_dev_loop-0.10.2.dist-info/entry_points.txt,sha256=Us59oHX6NBy-7ZN3LW5w3HAjnvOPJBfgNiv6ftnmHWw,70
-agentic_dev_loop-0.10.2.dist-info/top_level.txt,sha256=n1ktP1gXxGN6DJAnACR0mt276GRJB9PVDezf9DVPwaw,17
-agentic_dev_loop-0.10.2.dist-info/RECORD,,
+agentic_dev_loop-0.10.3.dist-info/licenses/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
+agentic_dev_loop-0.10.3.dist-info/METADATA,sha256=LTXvRTeuM44NCgguicRpew9dCO_8__FoxbBeYooCmsw,46341
+agentic_dev_loop-0.10.3.dist-info/WHEEL,sha256=mOdXR9C3wMVov7cSY8PY-XCzo3SmmWCHvGQr5csJoao,91
+agentic_dev_loop-0.10.3.dist-info/entry_points.txt,sha256=Us59oHX6NBy-7ZN3LW5w3HAjnvOPJBfgNiv6ftnmHWw,70
+agentic_dev_loop-0.10.3.dist-info/top_level.txt,sha256=n1ktP1gXxGN6DJAnACR0mt276GRJB9PVDezf9DVPwaw,17
+agentic_dev_loop-0.10.3.dist-info/RECORD,,