agentic-dev-loop 0.10.2__tar.gz → 0.10.3__tar.gz

{agentic_dev_loop-0.10.2/src/agentic_dev_loop.egg-info → agentic_dev_loop-0.10.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentic-dev-loop
-Version: 0.10.2
+Version: 0.10.3
 Summary: Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase.
 Author: Luke Wilson
 License-Expression: Apache-2.0
@@ -229,6 +229,7 @@ steps:
     agent: dev
     produces: implementation-summary.md
     terminal_timeout: 900
+    # forbidden_commands: ["npm install", "npm ci"]      # per-step tool deny-list; engine defaults are git mutations + docker
     on_pass: test
 
   - name: test
@@ -268,6 +269,7 @@ steps:
 | `brief_inputs:` | The discriminator for a native brief step: `{ include: [<paths/globs>], env_facts: [<strings>], sections: [<headings>] }`. There is no `agent:`, `produces:`, or `max_iterations:` - the prompt is engine-embedded, the capture file is `attempt-brief.md`, and the iteration cap is 12, all engine-owned. The engine resolves the include list against the workspace, passes the resolved docs + include contents + env facts as the step's task message, and regenerates the step only when those inputs change. `sections` is the ordered list of digest headings the brief must emit (default `[Repo rules digest, Unit scope digest, Environment facts, Open risks]`; non-empty and unique). `name` stays free-form, so multiple brief steps are allowed. |
 | `terminal_timeout:` | Optional agent-step per-action timeout in seconds (gt 0). `SandboxTerminalExecutor` uses it when the agent leaves the terminal action timeout unset, overriding the SDK tool's default. `None` = current behavior. |
 | `finalize_nudge_turns:` | Optional agent-step final-response nudge (gt 0). Requires `max_iterations:` and must be less than it. At `max_iterations - finalize_nudge_turns` completed turns the engine injects one advisory turn ("`N turns remain: produce your final response now`"), exactly once; the agent may still exhaust its turns and existing stuck/unclear handling applies unchanged. Absent = current behavior. Provisional pending one consumer run (revert if noisy or the raised cap inflates cost). |
+| `forbidden_commands:` | Optional per-step list of regex patterns. The sandbox terminal matches them against each agent command before any shell spawn; a match returns a structured `[forbidden: <label>]` observation instead of running. A single string is coerced to a one-item list; an invalid regex fails at load. Defaults are run invariants only (git mutations, docker); tool-specific rules belong to the toolchain profile/recipe or the pipeline author. Command steps are unaffected. See [Banned commands](#banned-commands-forbidden_commands). |
 | `custom_prompt:` | Planned (planning-docs/040). Optional agent-step value: literal text, or a path whose file contents are read at load time, appended verbatim to the agent prompt at context assembly (after the prompt, before the task/artifacts). A value that looks like a path but names no file is a validation error. Agent steps only. |
 | `llms:` (top-level) / step `llm:` | Named LLM profiles, each a full `LlmConfig` (`model`, `base_url`, `api_key_env`, `timeout`, `reasoning_effort`). A step names one with `llm: <profile-name>`; the whole profile moves together (no partial merges). Allowed only on agent and brief steps. The top-level `llm:` block remains the default. Profile keys are host-side - sandbox access still goes through `secrets:`. |
 | `reasoning_effort:` | Optional `low` / `medium` / `high` / `xhigh` / `none`. Set on the `llm` block, a `llms:` profile, or per-step (a step value overrides the effective profile's). Unset anywhere = reasoning off: nothing is forwarded and reasoning is stripped from requests. A thinking model without an effort level is invalid config and fails at the first request (crap in, crap out). See [Reasoning effort](#reasoning-effort-opt-in). |
@@ -284,6 +286,22 @@ steps:
 | `caches:` / `sync_excludes:` | Top-level run-wide lists. `caches:` names repo-relative toolchain cache dirs bind-mounted rw from host-side stores under `{state_dir}/caches/<name>` (auto-created); a `setup:` hook can warm them (the provision container carries the same cache mounts); `sync_excludes:` names non-gitignored scratch paths skipped from both the export copy and sync-back (wildcard `*` spans separators, so `**/bin/**` matches a `/bin/` segment at any depth). Both default to `[]`. See [docs/setup.md](docs/setup.md). |
 | `merge_on_conflict:` | Top-level run-wide list of append-style logs (same path vocabulary as `sync_excludes:`, default `[]`). A concurrent host edit to a listed path is union-merged instead of raising: the host file wins and the sandbox's export-only lines are appended in order; both sides converge and the run continues. See [docs/setup.md](docs/setup.md). |
 
+### Banned commands (`forbidden_commands:`)
+
+`forbidden_commands:` is a per-step list of regex patterns. The sandbox
+terminal checks them against every command the agent runs, before any shell
+spawn: a match returns a structured `[forbidden: <label>]` observation instead
+of executing. The engine defaults are run invariants only - git mutations and
+docker - so the deny-list is network-independent by design: `network:` stays a
+docker/egress concern. A single string is coerced to a one-item list; an
+invalid regex is a load error. Command steps bypass the filter by design.
+
+Tool-specific rules are not engine defaults. A toolchain profile or bundled
+recipe declares them per step (for example the `python` recipe denies
+`pip install`, `uv add`, and `pip-compile` on its agent steps), and a
+consumer pipeline authors its own for its toolchain. There is no disable
+escape hatch for the engine defaults.
+
 ### Reasoning effort (opt-in)
 
 `reasoning_effort` is an opt-in latency dial on the pipeline `llm` block, a

{agentic_dev_loop-0.10.2 → agentic_dev_loop-0.10.3}/README.md

@@ -185,6 +185,7 @@ steps:
     agent: dev
     produces: implementation-summary.md
     terminal_timeout: 900
+    # forbidden_commands: ["npm install", "npm ci"]      # per-step tool deny-list; engine defaults are git mutations + docker
     on_pass: test
 
   - name: test
@@ -224,6 +225,7 @@ steps:
 | `brief_inputs:` | The discriminator for a native brief step: `{ include: [<paths/globs>], env_facts: [<strings>], sections: [<headings>] }`. There is no `agent:`, `produces:`, or `max_iterations:` - the prompt is engine-embedded, the capture file is `attempt-brief.md`, and the iteration cap is 12, all engine-owned. The engine resolves the include list against the workspace, passes the resolved docs + include contents + env facts as the step's task message, and regenerates the step only when those inputs change. `sections` is the ordered list of digest headings the brief must emit (default `[Repo rules digest, Unit scope digest, Environment facts, Open risks]`; non-empty and unique). `name` stays free-form, so multiple brief steps are allowed. |
 | `terminal_timeout:` | Optional agent-step per-action timeout in seconds (gt 0). `SandboxTerminalExecutor` uses it when the agent leaves the terminal action timeout unset, overriding the SDK tool's default. `None` = current behavior. |
 | `finalize_nudge_turns:` | Optional agent-step final-response nudge (gt 0). Requires `max_iterations:` and must be less than it. At `max_iterations - finalize_nudge_turns` completed turns the engine injects one advisory turn ("`N turns remain: produce your final response now`"), exactly once; the agent may still exhaust its turns and existing stuck/unclear handling applies unchanged. Absent = current behavior. Provisional pending one consumer run (revert if noisy or the raised cap inflates cost). |
+| `forbidden_commands:` | Optional per-step list of regex patterns. The sandbox terminal matches them against each agent command before any shell spawn; a match returns a structured `[forbidden: <label>]` observation instead of running. A single string is coerced to a one-item list; an invalid regex fails at load. Defaults are run invariants only (git mutations, docker); tool-specific rules belong to the toolchain profile/recipe or the pipeline author. Command steps are unaffected. See [Banned commands](#banned-commands-forbidden_commands). |
 | `custom_prompt:` | Planned (planning-docs/040). Optional agent-step value: literal text, or a path whose file contents are read at load time, appended verbatim to the agent prompt at context assembly (after the prompt, before the task/artifacts). A value that looks like a path but names no file is a validation error. Agent steps only. |
 | `llms:` (top-level) / step `llm:` | Named LLM profiles, each a full `LlmConfig` (`model`, `base_url`, `api_key_env`, `timeout`, `reasoning_effort`). A step names one with `llm: <profile-name>`; the whole profile moves together (no partial merges). Allowed only on agent and brief steps. The top-level `llm:` block remains the default. Profile keys are host-side - sandbox access still goes through `secrets:`. |
 | `reasoning_effort:` | Optional `low` / `medium` / `high` / `xhigh` / `none`. Set on the `llm` block, a `llms:` profile, or per-step (a step value overrides the effective profile's). Unset anywhere = reasoning off: nothing is forwarded and reasoning is stripped from requests. A thinking model without an effort level is invalid config and fails at the first request (crap in, crap out). See [Reasoning effort](#reasoning-effort-opt-in). |
@@ -240,6 +242,22 @@ steps:
 | `caches:` / `sync_excludes:` | Top-level run-wide lists. `caches:` names repo-relative toolchain cache dirs bind-mounted rw from host-side stores under `{state_dir}/caches/<name>` (auto-created); a `setup:` hook can warm them (the provision container carries the same cache mounts); `sync_excludes:` names non-gitignored scratch paths skipped from both the export copy and sync-back (wildcard `*` spans separators, so `**/bin/**` matches a `/bin/` segment at any depth). Both default to `[]`. See [docs/setup.md](docs/setup.md). |
 | `merge_on_conflict:` | Top-level run-wide list of append-style logs (same path vocabulary as `sync_excludes:`, default `[]`). A concurrent host edit to a listed path is union-merged instead of raising: the host file wins and the sandbox's export-only lines are appended in order; both sides converge and the run continues. See [docs/setup.md](docs/setup.md). |
 
+### Banned commands (`forbidden_commands:`)
+
+`forbidden_commands:` is a per-step list of regex patterns. The sandbox
+terminal checks them against every command the agent runs, before any shell
+spawn: a match returns a structured `[forbidden: <label>]` observation instead
+of executing. The engine defaults are run invariants only - git mutations and
+docker - so the deny-list is network-independent by design: `network:` stays a
+docker/egress concern. A single string is coerced to a one-item list; an
+invalid regex is a load error. Command steps bypass the filter by design.
+
+Tool-specific rules are not engine defaults. A toolchain profile or bundled
+recipe declares them per step (for example the `python` recipe denies
+`pip install`, `uv add`, and `pip-compile` on its agent steps), and a
+consumer pipeline authors its own for its toolchain. There is no disable
+escape hatch for the engine defaults.
+
 ### Reasoning effort (opt-in)
 
 `reasoning_effort` is an opt-in latency dial on the pipeline `llm` block, a

{agentic_dev_loop-0.10.2 → agentic_dev_loop-0.10.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agentic-dev-loop"
-version = "0.10.2"
+version = "0.10.3"
 description = "Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase."
 readme = "README.md"
 requires-python = ">=3.12"

{agentic_dev_loop-0.10.2 → agentic_dev_loop-0.10.3}/src/agentic_dev_loop/engine/forbidden.py

@@ -1,4 +1,4 @@
-"""Banned-command deny-list (036 D1).
+"""Banned-command deny-list (036 D1, revised by 056).
 
 The sandbox terminal enforces a deny-list before any shell spawn: a command
 whose argv matches a step's ``forbidden_commands:`` regex (merged with the
@@ -6,11 +6,15 @@ engine defaults) returns a structured observation instead of reaching the
 sandbox. Command steps are unaffected - they are declared infrastructure and
 already fail fast on their exit code.
 
+The defaults are run invariants only: git mutations and docker.
+Tool-specific rules are not engine defaults - a step declares them with
+``forbidden_commands`` (the bundled onboarding recipes carry the engine's
+own toolchain guidance). The deny-list is network-independent by design;
+network is a sandbox egress concern.
+
 The default list carries human-readable labels; custom entries use their
-regex text as the label. ``dotnet restore`` and ``dotnet add`` are network
-gated: denied only while the step's ``network:`` flag is off.
+regex text as the label.
 """
-
 from __future__ import annotations
 
 import re
@@ -30,22 +34,9 @@ _DEFAULT_PATTERNS: tuple[tuple[str, str], ...] = (
     ("git checkout", r"\bgit\s+checkout\b"),
     ("git reset", r"\bgit\s+reset\b"),
     ("git tag", r"\bgit\s+tag\b"),
-    ("npm install", r"\bnpm\s+install\b"),
-    ("npm ci", r"\bnpm\s+ci\b"),
-    ("pip install", r"\bpip\s+install\b"),
-    ("uv add", r"\buv\s+add\b"),
-    ("pip-compile", r"\bpip-compile\b"),
-    ("dotnet add package", r"\bdotnet\s+add\s+package\b"),
-    ("npx playwright", r"\bnpx\s+playwright\b"),
-    ("playwright", r"\bplaywright\b"),
     ("docker", r"\bdocker\b"),
 )
 
-_NETWORK_GATED_PATTERNS: tuple[tuple[str, str], ...] = (
-    ("dotnet restore", r"\bdotnet\s+restore\b"),
-    ("dotnet add", r"\bdotnet\s+add\b"),
-)
-
 
 def _compile(label: str, pattern: str) -> ForbiddenRule:
     return ForbiddenRule(label=label, regex=re.compile(pattern, re.IGNORECASE))
@@ -54,21 +45,16 @@ def _compile(label: str, pattern: str) -> ForbiddenRule:
 DEFAULT_FORBIDDEN_RULES: tuple[ForbiddenRule, ...] = tuple(
     _compile(label, pattern) for label, pattern in _DEFAULT_PATTERNS)
 
-NETWORK_GATED_FORBIDDEN_RULES: tuple[ForbiddenRule, ...] = tuple(
-    _compile(label, pattern) for label, pattern in _NETWORK_GATED_PATTERNS)
-
 
-def resolve_forbidden_rules(custom_patterns: list[str] | tuple[str, ...] | None,
-                            network: bool) -> tuple[ForbiddenRule, ...]:
+def resolve_forbidden_rules(
+        custom_patterns: list[str] | tuple[str, ...] | None,
+) -> tuple[ForbiddenRule, ...]:
     """Merge the engine defaults with a step's custom regex list.
 
     Custom entries are appended after the defaults, so the first match wins
-    on overlap. Network-gated defaults are included only while ``network`` is
-    off; there is no disable escape hatch for the engine defaults.
+    on overlap; there is no disable escape hatch for the engine defaults.
     """
     rules = list(DEFAULT_FORBIDDEN_RULES)
-    if not network:
-        rules.extend(NETWORK_GATED_FORBIDDEN_RULES)
     for pattern in custom_patterns or ():
         rules.append(_compile(pattern, pattern))
     return tuple(rules)

{agentic_dev_loop-0.10.2 → agentic_dev_loop-0.10.3}/src/agentic_dev_loop/engine/onboarding/recipes/dotnet-node.yaml

@@ -14,7 +14,18 @@ dev_impossible_set:
   - "database-category tests"
   - "commands that boot servers or need external services"
 steps:
-  - {name: brief, kind: brief, brief_inputs: {include: [AGENTS.md]}, on_pass: dev}
+  - name: brief
+    kind: brief
+    brief_inputs: {include: [AGENTS.md]}
+    forbidden_commands:
+      - npm install
+      - npm ci
+      - dotnet add package
+      - dotnet restore
+      - dotnet add
+      - npx playwright
+      - playwright
+    on_pass: dev
   - name: dev
     kind: agent
     agent: dev
@@ -22,6 +33,14 @@ steps:
     max_iterations: 100
     finalize_nudge_turns: 10
     produces: implementation-summary.md
+    forbidden_commands:
+      - npm install
+      - npm ci
+      - dotnet add package
+      - dotnet restore
+      - dotnet add
+      - npx playwright
+      - playwright
     setup: 'cd __FRONTEND_DIR__ && npm ci && cd .. && dotnet restore __SOLUTION__'
     mounts: [{path: ".", mode: rw}]
     on_pass: restore
@@ -62,9 +81,23 @@ steps:
     optional: {detect: tools/run-conformance.sh}
     on_pass: review
     on_fail: {goto: dev, retry: true}
-  - {name: review, kind: agent, agent: review, reasoning_effort: xhigh,
-     artifact: review-findings.md, verdicts: {pass: APPROVED, fail: NEEDS CHANGES},
-     mounts: [{path: ".", mode: ro}], on_pass: qa, on_fail: {goto: dev, retry: true}}
+  - name: review
+    kind: agent
+    agent: review
+    reasoning_effort: xhigh
+    artifact: review-findings.md
+    verdicts: {pass: APPROVED, fail: NEEDS CHANGES}
+    mounts: [{path: ".", mode: ro}]
+    forbidden_commands:
+      - npm install
+      - npm ci
+      - dotnet add package
+      - dotnet restore
+      - dotnet add
+      - npx playwright
+      - playwright
+    on_pass: qa
+    on_fail: {goto: dev, retry: true}
   - name: qa
     kind: agent
     agent: qa

{agentic_dev_loop-0.10.2 → agentic_dev_loop-0.10.3}/src/agentic_dev_loop/engine/onboarding/recipes/python.yaml

@@ -11,7 +11,14 @@ brief_env_facts:
 dev_impossible_set:
   - "package-manager fetches after a new pin run only in the network-on restore step"
 steps:
-  - {name: brief, kind: brief, brief_inputs: {include: [AGENTS.md]}, on_pass: dev}
+  - name: brief
+    kind: brief
+    brief_inputs: {include: [AGENTS.md]}
+    forbidden_commands:
+      - pip install
+      - uv add
+      - pip-compile
+    on_pass: dev
   - name: dev
     kind: agent
     agent: dev
@@ -19,6 +26,10 @@ steps:
     max_iterations: 150
     finalize_nudge_turns: 10
     produces: implementation-summary.md
+    forbidden_commands:
+      - pip install
+      - uv add
+      - pip-compile
     setup: 'python -m venv __VENV__ && __VENV__/bin/pip install -e "__DEV_EXTRAS__"'
     mounts: [{path: ".", mode: rw}]
     on_pass: restore
@@ -38,9 +49,19 @@ steps:
     mounts: [{path: ".", mode: rw}]
     on_pass: review
     on_fail: {goto: dev, retry: true}
-  - {name: review, kind: agent, agent: review, reasoning_effort: xhigh,
-     artifact: review-findings.md, verdicts: {pass: APPROVED, fail: NEEDS CHANGES},
-     mounts: [{path: ".", mode: ro}], on_pass: qa, on_fail: {goto: dev, retry: true}}
+  - name: review
+    kind: agent
+    agent: review
+    reasoning_effort: xhigh
+    artifact: review-findings.md
+    verdicts: {pass: APPROVED, fail: NEEDS CHANGES}
+    mounts: [{path: ".", mode: ro}]
+    forbidden_commands:
+      - pip install
+      - uv add
+      - pip-compile
+    on_pass: qa
+    on_fail: {goto: dev, retry: true}
   - name: qa
     kind: agent
     agent: qa

{agentic_dev_loop-0.10.2 → agentic_dev_loop-0.10.3}/src/agentic_dev_loop/engine/stages.py

@@ -158,8 +158,7 @@ class Runtime:
                 else:
                     cwd, mount_set, egress_policy = (self.workspace, None, None)
                 forbidden_commands = (
-                    resolve_forbidden_rules(step.forbidden_commands,
-                                            step.network)
+                    resolve_forbidden_rules(step.forbidden_commands)
                     if step is not None else None)
                 allowlist = (
                     tuple(self.engine_allowlist)

{agentic_dev_loop-0.10.2 → agentic_dev_loop-0.10.3/src/agentic_dev_loop.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentic-dev-loop
-Version: 0.10.2
+Version: 0.10.3
 Summary: Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase.
 Author: Luke Wilson
 License-Expression: Apache-2.0
@@ -229,6 +229,7 @@ steps:
     agent: dev
     produces: implementation-summary.md
     terminal_timeout: 900
+    # forbidden_commands: ["npm install", "npm ci"]      # per-step tool deny-list; engine defaults are git mutations + docker
     on_pass: test
 
   - name: test
@@ -268,6 +269,7 @@ steps:
 | `brief_inputs:` | The discriminator for a native brief step: `{ include: [<paths/globs>], env_facts: [<strings>], sections: [<headings>] }`. There is no `agent:`, `produces:`, or `max_iterations:` - the prompt is engine-embedded, the capture file is `attempt-brief.md`, and the iteration cap is 12, all engine-owned. The engine resolves the include list against the workspace, passes the resolved docs + include contents + env facts as the step's task message, and regenerates the step only when those inputs change. `sections` is the ordered list of digest headings the brief must emit (default `[Repo rules digest, Unit scope digest, Environment facts, Open risks]`; non-empty and unique). `name` stays free-form, so multiple brief steps are allowed. |
 | `terminal_timeout:` | Optional agent-step per-action timeout in seconds (gt 0). `SandboxTerminalExecutor` uses it when the agent leaves the terminal action timeout unset, overriding the SDK tool's default. `None` = current behavior. |
 | `finalize_nudge_turns:` | Optional agent-step final-response nudge (gt 0). Requires `max_iterations:` and must be less than it. At `max_iterations - finalize_nudge_turns` completed turns the engine injects one advisory turn ("`N turns remain: produce your final response now`"), exactly once; the agent may still exhaust its turns and existing stuck/unclear handling applies unchanged. Absent = current behavior. Provisional pending one consumer run (revert if noisy or the raised cap inflates cost). |
+| `forbidden_commands:` | Optional per-step list of regex patterns. The sandbox terminal matches them against each agent command before any shell spawn; a match returns a structured `[forbidden: <label>]` observation instead of running. A single string is coerced to a one-item list; an invalid regex fails at load. Defaults are run invariants only (git mutations, docker); tool-specific rules belong to the toolchain profile/recipe or the pipeline author. Command steps are unaffected. See [Banned commands](#banned-commands-forbidden_commands). |
 | `custom_prompt:` | Planned (planning-docs/040). Optional agent-step value: literal text, or a path whose file contents are read at load time, appended verbatim to the agent prompt at context assembly (after the prompt, before the task/artifacts). A value that looks like a path but names no file is a validation error. Agent steps only. |
 | `llms:` (top-level) / step `llm:` | Named LLM profiles, each a full `LlmConfig` (`model`, `base_url`, `api_key_env`, `timeout`, `reasoning_effort`). A step names one with `llm: <profile-name>`; the whole profile moves together (no partial merges). Allowed only on agent and brief steps. The top-level `llm:` block remains the default. Profile keys are host-side - sandbox access still goes through `secrets:`. |
 | `reasoning_effort:` | Optional `low` / `medium` / `high` / `xhigh` / `none`. Set on the `llm` block, a `llms:` profile, or per-step (a step value overrides the effective profile's). Unset anywhere = reasoning off: nothing is forwarded and reasoning is stripped from requests. A thinking model without an effort level is invalid config and fails at the first request (crap in, crap out). See [Reasoning effort](#reasoning-effort-opt-in). |
@@ -284,6 +286,22 @@ steps:
 | `caches:` / `sync_excludes:` | Top-level run-wide lists. `caches:` names repo-relative toolchain cache dirs bind-mounted rw from host-side stores under `{state_dir}/caches/<name>` (auto-created); a `setup:` hook can warm them (the provision container carries the same cache mounts); `sync_excludes:` names non-gitignored scratch paths skipped from both the export copy and sync-back (wildcard `*` spans separators, so `**/bin/**` matches a `/bin/` segment at any depth). Both default to `[]`. See [docs/setup.md](docs/setup.md). |
 | `merge_on_conflict:` | Top-level run-wide list of append-style logs (same path vocabulary as `sync_excludes:`, default `[]`). A concurrent host edit to a listed path is union-merged instead of raising: the host file wins and the sandbox's export-only lines are appended in order; both sides converge and the run continues. See [docs/setup.md](docs/setup.md). |
 
+### Banned commands (`forbidden_commands:`)
+
+`forbidden_commands:` is a per-step list of regex patterns. The sandbox
+terminal checks them against every command the agent runs, before any shell
+spawn: a match returns a structured `[forbidden: <label>]` observation instead
+of executing. The engine defaults are run invariants only - git mutations and
+docker - so the deny-list is network-independent by design: `network:` stays a
+docker/egress concern. A single string is coerced to a one-item list; an
+invalid regex is a load error. Command steps bypass the filter by design.
+
+Tool-specific rules are not engine defaults. A toolchain profile or bundled
+recipe declares them per step (for example the `python` recipe denies
+`pip install`, `uv add`, and `pip-compile` on its agent steps), and a
+consumer pipeline authors its own for its toolchain. There is no disable
+escape hatch for the engine defaults.
+
 ### Reasoning effort (opt-in)
 
 `reasoning_effort` is an opt-in latency dial on the pipeline `llm` block, a

{agentic_dev_loop-0.10.2 → agentic_dev_loop-0.10.3}/tests/test_036_banned_commands_and_lane_boundary.py

@@ -48,34 +48,21 @@ def _export(tmp_path: Path, ws: Path) -> Path:
 
 class TestForbiddenCommandRules:
     def test_defaults_cover_deny_list(self):
-        rules = resolve_forbidden_rules([], network=False)
+        rules = resolve_forbidden_rules([])
         labels = [r.label for r in rules]
-        for expected in ("git commit", "git push", "git rebase", "git checkout",
-                         "git reset", "git tag", "npm install", "npm ci",
-                         "pip install", "uv add", "pip-compile",
-                         "dotnet add package", "npx playwright", "playwright",
-                         "docker", "dotnet restore", "dotnet add"):
-            assert expected in labels
-
-    def test_network_on_drops_network_gated_dotnet(self):
-        offline = resolve_forbidden_rules([], network=False)
-        online = resolve_forbidden_rules([], network=True)
-        assert "dotnet restore" in [r.label for r in offline]
-        assert "dotnet add" in [r.label for r in offline]
-        assert "dotnet restore" not in [r.label for r in online]
-        assert "dotnet add" not in [r.label for r in online]
+        assert labels == ['git commit', 'git push', 'git rebase', 'git checkout', 'git reset', 'git tag', 'docker']
 
     def test_custom_rules_append_with_pattern_label(self):
-        rules = resolve_forbidden_rules([r"rm\s+-rf"], network=False)
+        rules = resolve_forbidden_rules([r"rm\s+-rf"])
         assert rules[-1].label == r"rm\s+-rf"
 
     def test_shell_wrapped_argv_matches(self):
         argv = ["/bin/sh", "-c", "git push origin main"]
         assert match_forbidden_command(
-            argv, resolve_forbidden_rules([], network=False)) == "git push"
+            argv, resolve_forbidden_rules([])) == "git push"
 
     def test_empty_argv_never_matches(self):
-        assert match_forbidden_command([], resolve_forbidden_rules([], False)) is None
+        assert match_forbidden_command([], resolve_forbidden_rules([])) is None
 
 
 class TestSandboxTerminalDenyList:
@@ -86,7 +73,7 @@ class TestSandboxTerminalDenyList:
         from agentic_dev_loop.engine.agents import SandboxTerminalExecutor
         ex = SandboxTerminalExecutor(
             fake_sandbox, workspace=str(tmp_path), env={},
-            forbidden_commands=resolve_forbidden_rules([], network=False))
+            forbidden_commands=resolve_forbidden_rules([]))
         obs = ex(TerminalAction(command="git commit -m x"), None)
         assert "[forbidden: git commit]" in obs.text
         assert obs.exit_code is None
@@ -98,34 +85,11 @@ class TestSandboxTerminalDenyList:
         from agentic_dev_loop.engine.agents import SandboxTerminalExecutor
         ex = SandboxTerminalExecutor(
             fake_sandbox, workspace=str(tmp_path), env={},
-            forbidden_commands=resolve_forbidden_rules([r"rm\s+-rf"], False))
+            forbidden_commands=resolve_forbidden_rules([r"rm\s+-rf"]))
         obs = ex(TerminalAction(command="rm -rf /tmp/x"), None)
         assert "[forbidden: rm\\s+-rf]" in obs.text
         assert fake_sandbox.requests == []
 
-    def test_dotnet_restore_denied_offline(self, fake_sandbox, tmp_path):
-        from openhands.tools.terminal import TerminalAction
-
-        from agentic_dev_loop.engine.agents import SandboxTerminalExecutor
-        ex = SandboxTerminalExecutor(
-            fake_sandbox, workspace=str(tmp_path), env={},
-            forbidden_commands=resolve_forbidden_rules([], network=False))
-        obs = ex(TerminalAction(command="dotnet restore"), None)
-        assert "[forbidden: dotnet restore]" in obs.text
-        assert fake_sandbox.requests == []
-
-    def test_dotnet_restore_allowed_online(self, fake_sandbox, tmp_path):
-        from openhands.tools.terminal import TerminalAction
-
-        from agentic_dev_loop.engine.agents import SandboxTerminalExecutor
-        ex = SandboxTerminalExecutor(
-            fake_sandbox, workspace=str(tmp_path), env={}, network=True,
-            forbidden_commands=resolve_forbidden_rules([], network=True))
-        fake_sandbox.script(lambda req: (0, "restored", False))
-        obs = ex(TerminalAction(command="dotnet restore"), None)
-        assert obs.exit_code == 0
-        assert fake_sandbox.requests[0].argv == ["dotnet", "restore"]
-
 
 class TestPathAllowed:
     def test_literal_prefix(self):

{agentic_dev_loop-0.10.2 → agentic_dev_loop-0.10.3}/tests/test_055_recipes.py

@@ -47,6 +47,9 @@ def test_python_recipe_gate_set_and_commands():
     assert steps["qa"]["finalize_nudge_turns"] == 10
     assert "env" in steps["qa"]["verdicts"]
     assert "on_env" not in steps["qa"]
+    for name in ("brief", "dev", "review"):
+        assert steps[name]["forbidden_commands"] == ['pip install', 'uv add', 'pip-compile']
+    assert "forbidden_commands" not in steps["qa"]
 
 
 def test_dotnet_node_recipe_gate_set_and_commands():
@@ -69,6 +72,9 @@ def test_dotnet_node_recipe_gate_set_and_commands():
     assert steps["qa"]["env"] == {"PLAYWRIGHT_BROWSERS_PATH": "qa/.browsers"}
     assert steps["qa"]["mounts"] == [{"path": ".", "mode": "rw"}]
     assert len(doc["dev_impossible_set"]) == 4
+    for name in ("brief", "dev", "review"):
+        assert steps[name]["forbidden_commands"] == ['npm install', 'npm ci', 'dotnet add package', 'dotnet restore', 'dotnet add', 'npx playwright', 'playwright']
+    assert "forbidden_commands" not in steps["qa"]
 
 
 def test_unknown_recipe_raises():