agentic-dev-loop 0.10.2__tar.gz → 0.10.4__tar.gz

{agentic_dev_loop-0.10.2/src/agentic_dev_loop.egg-info → agentic_dev_loop-0.10.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentic-dev-loop
-Version: 0.10.2
+Version: 0.10.4
 Summary: Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase.
 Author: Luke Wilson
 License-Expression: Apache-2.0
@@ -229,6 +229,7 @@ steps:
     agent: dev
     produces: implementation-summary.md
     terminal_timeout: 900
+    # forbidden_commands: ["npm install", "npm ci"]      # per-step tool deny-list; engine defaults are git mutations + docker
     on_pass: test
 
   - name: test
@@ -268,6 +269,7 @@ steps:
 | `brief_inputs:` | The discriminator for a native brief step: `{ include: [<paths/globs>], env_facts: [<strings>], sections: [<headings>] }`. There is no `agent:`, `produces:`, or `max_iterations:` - the prompt is engine-embedded, the capture file is `attempt-brief.md`, and the iteration cap is 12, all engine-owned. The engine resolves the include list against the workspace, passes the resolved docs + include contents + env facts as the step's task message, and regenerates the step only when those inputs change. `sections` is the ordered list of digest headings the brief must emit (default `[Repo rules digest, Unit scope digest, Environment facts, Open risks]`; non-empty and unique). `name` stays free-form, so multiple brief steps are allowed. |
 | `terminal_timeout:` | Optional agent-step per-action timeout in seconds (gt 0). `SandboxTerminalExecutor` uses it when the agent leaves the terminal action timeout unset, overriding the SDK tool's default. `None` = current behavior. |
 | `finalize_nudge_turns:` | Optional agent-step final-response nudge (gt 0). Requires `max_iterations:` and must be less than it. At `max_iterations - finalize_nudge_turns` completed turns the engine injects one advisory turn ("`N turns remain: produce your final response now`"), exactly once; the agent may still exhaust its turns and existing stuck/unclear handling applies unchanged. Absent = current behavior. Provisional pending one consumer run (revert if noisy or the raised cap inflates cost). |
+| `forbidden_commands:` | Optional per-step list of regex patterns. The sandbox terminal matches them against each agent command before any shell spawn; a match returns a structured `[forbidden: <label>]` observation instead of running. A single string is coerced to a one-item list; an invalid regex fails at load. Defaults are run invariants only (git mutations, docker); tool-specific rules belong to the toolchain profile/recipe or the pipeline author. Command steps are unaffected. See [Banned commands](#banned-commands-forbidden_commands). |
 | `custom_prompt:` | Planned (planning-docs/040). Optional agent-step value: literal text, or a path whose file contents are read at load time, appended verbatim to the agent prompt at context assembly (after the prompt, before the task/artifacts). A value that looks like a path but names no file is a validation error. Agent steps only. |
 | `llms:` (top-level) / step `llm:` | Named LLM profiles, each a full `LlmConfig` (`model`, `base_url`, `api_key_env`, `timeout`, `reasoning_effort`). A step names one with `llm: <profile-name>`; the whole profile moves together (no partial merges). Allowed only on agent and brief steps. The top-level `llm:` block remains the default. Profile keys are host-side - sandbox access still goes through `secrets:`. |
 | `reasoning_effort:` | Optional `low` / `medium` / `high` / `xhigh` / `none`. Set on the `llm` block, a `llms:` profile, or per-step (a step value overrides the effective profile's). Unset anywhere = reasoning off: nothing is forwarded and reasoning is stripped from requests. A thinking model without an effort level is invalid config and fails at the first request (crap in, crap out). See [Reasoning effort](#reasoning-effort-opt-in). |
@@ -284,6 +286,22 @@ steps:
 | `caches:` / `sync_excludes:` | Top-level run-wide lists. `caches:` names repo-relative toolchain cache dirs bind-mounted rw from host-side stores under `{state_dir}/caches/<name>` (auto-created); a `setup:` hook can warm them (the provision container carries the same cache mounts); `sync_excludes:` names non-gitignored scratch paths skipped from both the export copy and sync-back (wildcard `*` spans separators, so `**/bin/**` matches a `/bin/` segment at any depth). Both default to `[]`. See [docs/setup.md](docs/setup.md). |
 | `merge_on_conflict:` | Top-level run-wide list of append-style logs (same path vocabulary as `sync_excludes:`, default `[]`). A concurrent host edit to a listed path is union-merged instead of raising: the host file wins and the sandbox's export-only lines are appended in order; both sides converge and the run continues. See [docs/setup.md](docs/setup.md). |
 
+### Banned commands (`forbidden_commands:`)
+
+`forbidden_commands:` is a per-step list of regex patterns. The sandbox
+terminal checks them against every command the agent runs, before any shell
+spawn: a match returns a structured `[forbidden: <label>]` observation instead
+of executing. The engine defaults are run invariants only - git mutations and
+docker - so the deny-list is network-independent by design: `network:` stays a
+docker/egress concern. A single string is coerced to a one-item list; an
+invalid regex is a load error. Command steps bypass the filter by design.
+
+Tool-specific rules are not engine defaults. A toolchain profile or bundled
+recipe declares them per step (for example the `python` recipe denies
+`pip install`, `uv add`, and `pip-compile` on its agent steps), and a
+consumer pipeline authors its own for its toolchain. There is no disable
+escape hatch for the engine defaults.
+
 ### Reasoning effort (opt-in)
 
 `reasoning_effort` is an opt-in latency dial on the pipeline `llm` block, a

{agentic_dev_loop-0.10.2 → agentic_dev_loop-0.10.4}/README.md

@@ -185,6 +185,7 @@ steps:
     agent: dev
     produces: implementation-summary.md
     terminal_timeout: 900
+    # forbidden_commands: ["npm install", "npm ci"]      # per-step tool deny-list; engine defaults are git mutations + docker
     on_pass: test
 
   - name: test
@@ -224,6 +225,7 @@ steps:
 | `brief_inputs:` | The discriminator for a native brief step: `{ include: [<paths/globs>], env_facts: [<strings>], sections: [<headings>] }`. There is no `agent:`, `produces:`, or `max_iterations:` - the prompt is engine-embedded, the capture file is `attempt-brief.md`, and the iteration cap is 12, all engine-owned. The engine resolves the include list against the workspace, passes the resolved docs + include contents + env facts as the step's task message, and regenerates the step only when those inputs change. `sections` is the ordered list of digest headings the brief must emit (default `[Repo rules digest, Unit scope digest, Environment facts, Open risks]`; non-empty and unique). `name` stays free-form, so multiple brief steps are allowed. |
 | `terminal_timeout:` | Optional agent-step per-action timeout in seconds (gt 0). `SandboxTerminalExecutor` uses it when the agent leaves the terminal action timeout unset, overriding the SDK tool's default. `None` = current behavior. |
 | `finalize_nudge_turns:` | Optional agent-step final-response nudge (gt 0). Requires `max_iterations:` and must be less than it. At `max_iterations - finalize_nudge_turns` completed turns the engine injects one advisory turn ("`N turns remain: produce your final response now`"), exactly once; the agent may still exhaust its turns and existing stuck/unclear handling applies unchanged. Absent = current behavior. Provisional pending one consumer run (revert if noisy or the raised cap inflates cost). |
+| `forbidden_commands:` | Optional per-step list of regex patterns. The sandbox terminal matches them against each agent command before any shell spawn; a match returns a structured `[forbidden: <label>]` observation instead of running. A single string is coerced to a one-item list; an invalid regex fails at load. Defaults are run invariants only (git mutations, docker); tool-specific rules belong to the toolchain profile/recipe or the pipeline author. Command steps are unaffected. See [Banned commands](#banned-commands-forbidden_commands). |
 | `custom_prompt:` | Planned (planning-docs/040). Optional agent-step value: literal text, or a path whose file contents are read at load time, appended verbatim to the agent prompt at context assembly (after the prompt, before the task/artifacts). A value that looks like a path but names no file is a validation error. Agent steps only. |
 | `llms:` (top-level) / step `llm:` | Named LLM profiles, each a full `LlmConfig` (`model`, `base_url`, `api_key_env`, `timeout`, `reasoning_effort`). A step names one with `llm: <profile-name>`; the whole profile moves together (no partial merges). Allowed only on agent and brief steps. The top-level `llm:` block remains the default. Profile keys are host-side - sandbox access still goes through `secrets:`. |
 | `reasoning_effort:` | Optional `low` / `medium` / `high` / `xhigh` / `none`. Set on the `llm` block, a `llms:` profile, or per-step (a step value overrides the effective profile's). Unset anywhere = reasoning off: nothing is forwarded and reasoning is stripped from requests. A thinking model without an effort level is invalid config and fails at the first request (crap in, crap out). See [Reasoning effort](#reasoning-effort-opt-in). |
@@ -240,6 +242,22 @@ steps:
 | `caches:` / `sync_excludes:` | Top-level run-wide lists. `caches:` names repo-relative toolchain cache dirs bind-mounted rw from host-side stores under `{state_dir}/caches/<name>` (auto-created); a `setup:` hook can warm them (the provision container carries the same cache mounts); `sync_excludes:` names non-gitignored scratch paths skipped from both the export copy and sync-back (wildcard `*` spans separators, so `**/bin/**` matches a `/bin/` segment at any depth). Both default to `[]`. See [docs/setup.md](docs/setup.md). |
 | `merge_on_conflict:` | Top-level run-wide list of append-style logs (same path vocabulary as `sync_excludes:`, default `[]`). A concurrent host edit to a listed path is union-merged instead of raising: the host file wins and the sandbox's export-only lines are appended in order; both sides converge and the run continues. See [docs/setup.md](docs/setup.md). |
 
+### Banned commands (`forbidden_commands:`)
+
+`forbidden_commands:` is a per-step list of regex patterns. The sandbox
+terminal checks them against every command the agent runs, before any shell
+spawn: a match returns a structured `[forbidden: <label>]` observation instead
+of executing. The engine defaults are run invariants only - git mutations and
+docker - so the deny-list is network-independent by design: `network:` stays a
+docker/egress concern. A single string is coerced to a one-item list; an
+invalid regex is a load error. Command steps bypass the filter by design.
+
+Tool-specific rules are not engine defaults. A toolchain profile or bundled
+recipe declares them per step (for example the `python` recipe denies
+`pip install`, `uv add`, and `pip-compile` on its agent steps), and a
+consumer pipeline authors its own for its toolchain. There is no disable
+escape hatch for the engine defaults.
+
 ### Reasoning effort (opt-in)
 
 `reasoning_effort` is an opt-in latency dial on the pipeline `llm` block, a

{agentic_dev_loop-0.10.2 → agentic_dev_loop-0.10.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agentic-dev-loop"
-version = "0.10.2"
+version = "0.10.4"
 description = "Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase."
 readme = "README.md"
 requires-python = ">=3.12"

{agentic_dev_loop-0.10.2 → agentic_dev_loop-0.10.4}/src/agentic_dev_loop/engine/extensions/aidlc.py

@@ -74,12 +74,18 @@ def resolve_unit_docs_with_sources(
                 sources[f"inception/{file.name}"] = file
 
     # The unit's code-generation plans are the build spec - absent is fine,
-    # present is how the spec reaches agents.
+    # present is how the spec reaches agents. Two shapes are in the wild:
+    # bare (`unit-3-code-generation-plan.md`) and infixed
+    # (`unit-3-scan-core-types-code-generation-plan.md`); the bare shape must
+    # not be lost, and neither pattern may leak into a slug that merely
+    # extends this one (unit-3 must not match a unit-30 plan).
     plans_dir = docs_dir / "construction" / "plans"
     if plans_dir.is_dir():
-        for file in sorted(plans_dir.glob(f"{unit_slug}-*-code-generation-plan.md")):
-            docs[f"plans/{file.name}"] = file.read_text(encoding="utf-8")
-            sources[f"plans/{file.name}"] = file
+        for pattern in (f"{unit_slug}-code-generation-plan.md",
+                        f"{unit_slug}-*-code-generation-plan.md"):
+            for file in sorted(plans_dir.glob(pattern)):
+                docs[f"plans/{file.name}"] = file.read_text(encoding="utf-8")
+                sources[f"plans/{file.name}"] = file
 
     return docs, sources
 

{agentic_dev_loop-0.10.2 → agentic_dev_loop-0.10.4}/src/agentic_dev_loop/engine/forbidden.py

@@ -1,4 +1,4 @@
-"""Banned-command deny-list (036 D1).
+"""Banned-command deny-list (036 D1, revised by 056).
 
 The sandbox terminal enforces a deny-list before any shell spawn: a command
 whose argv matches a step's ``forbidden_commands:`` regex (merged with the
@@ -6,11 +6,15 @@ engine defaults) returns a structured observation instead of reaching the
 sandbox. Command steps are unaffected - they are declared infrastructure and
 already fail fast on their exit code.
 
+The defaults are run invariants only: git mutations and docker.
+Tool-specific rules are not engine defaults - a step declares them with
+``forbidden_commands`` (the bundled onboarding recipes carry the engine's
+own toolchain guidance). The deny-list is network-independent by design;
+network is a sandbox egress concern.
+
 The default list carries human-readable labels; custom entries use their
-regex text as the label. ``dotnet restore`` and ``dotnet add`` are network
-gated: denied only while the step's ``network:`` flag is off.
+regex text as the label.
 """
-
 from __future__ import annotations
 
 import re
@@ -30,22 +34,9 @@ _DEFAULT_PATTERNS: tuple[tuple[str, str], ...] = (
     ("git checkout", r"\bgit\s+checkout\b"),
     ("git reset", r"\bgit\s+reset\b"),
     ("git tag", r"\bgit\s+tag\b"),
-    ("npm install", r"\bnpm\s+install\b"),
-    ("npm ci", r"\bnpm\s+ci\b"),
-    ("pip install", r"\bpip\s+install\b"),
-    ("uv add", r"\buv\s+add\b"),
-    ("pip-compile", r"\bpip-compile\b"),
-    ("dotnet add package", r"\bdotnet\s+add\s+package\b"),
-    ("npx playwright", r"\bnpx\s+playwright\b"),
-    ("playwright", r"\bplaywright\b"),
     ("docker", r"\bdocker\b"),
 )
 
-_NETWORK_GATED_PATTERNS: tuple[tuple[str, str], ...] = (
-    ("dotnet restore", r"\bdotnet\s+restore\b"),
-    ("dotnet add", r"\bdotnet\s+add\b"),
-)
-
 
 def _compile(label: str, pattern: str) -> ForbiddenRule:
     return ForbiddenRule(label=label, regex=re.compile(pattern, re.IGNORECASE))
@@ -54,21 +45,16 @@ def _compile(label: str, pattern: str) -> ForbiddenRule:
 DEFAULT_FORBIDDEN_RULES: tuple[ForbiddenRule, ...] = tuple(
     _compile(label, pattern) for label, pattern in _DEFAULT_PATTERNS)
 
-NETWORK_GATED_FORBIDDEN_RULES: tuple[ForbiddenRule, ...] = tuple(
-    _compile(label, pattern) for label, pattern in _NETWORK_GATED_PATTERNS)
-
 
-def resolve_forbidden_rules(custom_patterns: list[str] | tuple[str, ...] | None,
-                            network: bool) -> tuple[ForbiddenRule, ...]:
+def resolve_forbidden_rules(
+        custom_patterns: list[str] | tuple[str, ...] | None,
+) -> tuple[ForbiddenRule, ...]:
     """Merge the engine defaults with a step's custom regex list.
 
     Custom entries are appended after the defaults, so the first match wins
-    on overlap. Network-gated defaults are included only while ``network`` is
-    off; there is no disable escape hatch for the engine defaults.
+    on overlap; there is no disable escape hatch for the engine defaults.
     """
     rules = list(DEFAULT_FORBIDDEN_RULES)
-    if not network:
-        rules.extend(NETWORK_GATED_FORBIDDEN_RULES)
     for pattern in custom_patterns or ():
         rules.append(_compile(pattern, pattern))
     return tuple(rules)

{agentic_dev_loop-0.10.2 → agentic_dev_loop-0.10.4}/src/agentic_dev_loop/engine/onboarding/recipes/dotnet-node.yaml

@@ -14,7 +14,18 @@ dev_impossible_set:
   - "database-category tests"
   - "commands that boot servers or need external services"
 steps:
-  - {name: brief, kind: brief, brief_inputs: {include: [AGENTS.md]}, on_pass: dev}
+  - name: brief
+    kind: brief
+    brief_inputs: {include: [AGENTS.md]}
+    forbidden_commands:
+      - npm install
+      - npm ci
+      - dotnet add package
+      - dotnet restore
+      - dotnet add
+      - npx playwright
+      - playwright
+    on_pass: dev
   - name: dev
     kind: agent
     agent: dev
@@ -22,6 +33,14 @@ steps:
     max_iterations: 100
     finalize_nudge_turns: 10
     produces: implementation-summary.md
+    forbidden_commands:
+      - npm install
+      - npm ci
+      - dotnet add package
+      - dotnet restore
+      - dotnet add
+      - npx playwright
+      - playwright
     setup: 'cd __FRONTEND_DIR__ && npm ci && cd .. && dotnet restore __SOLUTION__'
     mounts: [{path: ".", mode: rw}]
     on_pass: restore
@@ -62,9 +81,23 @@ steps:
     optional: {detect: tools/run-conformance.sh}
     on_pass: review
     on_fail: {goto: dev, retry: true}
-  - {name: review, kind: agent, agent: review, reasoning_effort: xhigh,
-     artifact: review-findings.md, verdicts: {pass: APPROVED, fail: NEEDS CHANGES},
-     mounts: [{path: ".", mode: ro}], on_pass: qa, on_fail: {goto: dev, retry: true}}
+  - name: review
+    kind: agent
+    agent: review
+    reasoning_effort: xhigh
+    artifact: review-findings.md
+    verdicts: {pass: APPROVED, fail: NEEDS CHANGES}
+    mounts: [{path: ".", mode: ro}]
+    forbidden_commands:
+      - npm install
+      - npm ci
+      - dotnet add package
+      - dotnet restore
+      - dotnet add
+      - npx playwright
+      - playwright
+    on_pass: qa
+    on_fail: {goto: dev, retry: true}
   - name: qa
     kind: agent
     agent: qa

{agentic_dev_loop-0.10.2 → agentic_dev_loop-0.10.4}/src/agentic_dev_loop/engine/onboarding/recipes/python.yaml

@@ -11,7 +11,14 @@ brief_env_facts:
 dev_impossible_set:
   - "package-manager fetches after a new pin run only in the network-on restore step"
 steps:
-  - {name: brief, kind: brief, brief_inputs: {include: [AGENTS.md]}, on_pass: dev}
+  - name: brief
+    kind: brief
+    brief_inputs: {include: [AGENTS.md]}
+    forbidden_commands:
+      - pip install
+      - uv add
+      - pip-compile
+    on_pass: dev
   - name: dev
     kind: agent
     agent: dev
@@ -19,6 +26,10 @@ steps:
     max_iterations: 150
     finalize_nudge_turns: 10
     produces: implementation-summary.md
+    forbidden_commands:
+      - pip install
+      - uv add
+      - pip-compile
     setup: 'python -m venv __VENV__ && __VENV__/bin/pip install -e "__DEV_EXTRAS__"'
     mounts: [{path: ".", mode: rw}]
     on_pass: restore
@@ -38,9 +49,19 @@ steps:
     mounts: [{path: ".", mode: rw}]
     on_pass: review
     on_fail: {goto: dev, retry: true}
-  - {name: review, kind: agent, agent: review, reasoning_effort: xhigh,
-     artifact: review-findings.md, verdicts: {pass: APPROVED, fail: NEEDS CHANGES},
-     mounts: [{path: ".", mode: ro}], on_pass: qa, on_fail: {goto: dev, retry: true}}
+  - name: review
+    kind: agent
+    agent: review
+    reasoning_effort: xhigh
+    artifact: review-findings.md
+    verdicts: {pass: APPROVED, fail: NEEDS CHANGES}
+    mounts: [{path: ".", mode: ro}]
+    forbidden_commands:
+      - pip install
+      - uv add
+      - pip-compile
+    on_pass: qa
+    on_fail: {goto: dev, retry: true}
   - name: qa
     kind: agent
     agent: qa

{agentic_dev_loop-0.10.2 → agentic_dev_loop-0.10.4}/src/agentic_dev_loop/engine/stages.py

@@ -158,8 +158,7 @@ class Runtime:
                 else:
                     cwd, mount_set, egress_policy = (self.workspace, None, None)
                 forbidden_commands = (
-                    resolve_forbidden_rules(step.forbidden_commands,
-                                            step.network)
+                    resolve_forbidden_rules(step.forbidden_commands)
                     if step is not None else None)
                 allowlist = (
                     tuple(self.engine_allowlist)

{agentic_dev_loop-0.10.2 → agentic_dev_loop-0.10.4/src/agentic_dev_loop.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentic-dev-loop
-Version: 0.10.2
+Version: 0.10.4
 Summary: Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase.
 Author: Luke Wilson
 License-Expression: Apache-2.0
@@ -229,6 +229,7 @@ steps:
     agent: dev
     produces: implementation-summary.md
     terminal_timeout: 900
+    # forbidden_commands: ["npm install", "npm ci"]      # per-step tool deny-list; engine defaults are git mutations + docker
     on_pass: test
 
   - name: test
@@ -268,6 +269,7 @@ steps:
 | `brief_inputs:` | The discriminator for a native brief step: `{ include: [<paths/globs>], env_facts: [<strings>], sections: [<headings>] }`. There is no `agent:`, `produces:`, or `max_iterations:` - the prompt is engine-embedded, the capture file is `attempt-brief.md`, and the iteration cap is 12, all engine-owned. The engine resolves the include list against the workspace, passes the resolved docs + include contents + env facts as the step's task message, and regenerates the step only when those inputs change. `sections` is the ordered list of digest headings the brief must emit (default `[Repo rules digest, Unit scope digest, Environment facts, Open risks]`; non-empty and unique). `name` stays free-form, so multiple brief steps are allowed. |
 | `terminal_timeout:` | Optional agent-step per-action timeout in seconds (gt 0). `SandboxTerminalExecutor` uses it when the agent leaves the terminal action timeout unset, overriding the SDK tool's default. `None` = current behavior. |
 | `finalize_nudge_turns:` | Optional agent-step final-response nudge (gt 0). Requires `max_iterations:` and must be less than it. At `max_iterations - finalize_nudge_turns` completed turns the engine injects one advisory turn ("`N turns remain: produce your final response now`"), exactly once; the agent may still exhaust its turns and existing stuck/unclear handling applies unchanged. Absent = current behavior. Provisional pending one consumer run (revert if noisy or the raised cap inflates cost). |
+| `forbidden_commands:` | Optional per-step list of regex patterns. The sandbox terminal matches them against each agent command before any shell spawn; a match returns a structured `[forbidden: <label>]` observation instead of running. A single string is coerced to a one-item list; an invalid regex fails at load. Defaults are run invariants only (git mutations, docker); tool-specific rules belong to the toolchain profile/recipe or the pipeline author. Command steps are unaffected. See [Banned commands](#banned-commands-forbidden_commands). |
 | `custom_prompt:` | Planned (planning-docs/040). Optional agent-step value: literal text, or a path whose file contents are read at load time, appended verbatim to the agent prompt at context assembly (after the prompt, before the task/artifacts). A value that looks like a path but names no file is a validation error. Agent steps only. |
 | `llms:` (top-level) / step `llm:` | Named LLM profiles, each a full `LlmConfig` (`model`, `base_url`, `api_key_env`, `timeout`, `reasoning_effort`). A step names one with `llm: <profile-name>`; the whole profile moves together (no partial merges). Allowed only on agent and brief steps. The top-level `llm:` block remains the default. Profile keys are host-side - sandbox access still goes through `secrets:`. |
 | `reasoning_effort:` | Optional `low` / `medium` / `high` / `xhigh` / `none`. Set on the `llm` block, a `llms:` profile, or per-step (a step value overrides the effective profile's). Unset anywhere = reasoning off: nothing is forwarded and reasoning is stripped from requests. A thinking model without an effort level is invalid config and fails at the first request (crap in, crap out). See [Reasoning effort](#reasoning-effort-opt-in). |
@@ -284,6 +286,22 @@ steps:
 | `caches:` / `sync_excludes:` | Top-level run-wide lists. `caches:` names repo-relative toolchain cache dirs bind-mounted rw from host-side stores under `{state_dir}/caches/<name>` (auto-created); a `setup:` hook can warm them (the provision container carries the same cache mounts); `sync_excludes:` names non-gitignored scratch paths skipped from both the export copy and sync-back (wildcard `*` spans separators, so `**/bin/**` matches a `/bin/` segment at any depth). Both default to `[]`. See [docs/setup.md](docs/setup.md). |
 | `merge_on_conflict:` | Top-level run-wide list of append-style logs (same path vocabulary as `sync_excludes:`, default `[]`). A concurrent host edit to a listed path is union-merged instead of raising: the host file wins and the sandbox's export-only lines are appended in order; both sides converge and the run continues. See [docs/setup.md](docs/setup.md). |
 
+### Banned commands (`forbidden_commands:`)
+
+`forbidden_commands:` is a per-step list of regex patterns. The sandbox
+terminal checks them against every command the agent runs, before any shell
+spawn: a match returns a structured `[forbidden: <label>]` observation instead
+of executing. The engine defaults are run invariants only - git mutations and
+docker - so the deny-list is network-independent by design: `network:` stays a
+docker/egress concern. A single string is coerced to a one-item list; an
+invalid regex is a load error. Command steps bypass the filter by design.
+
+Tool-specific rules are not engine defaults. A toolchain profile or bundled
+recipe declares them per step (for example the `python` recipe denies
+`pip install`, `uv add`, and `pip-compile` on its agent steps), and a
+consumer pipeline authors its own for its toolchain. There is no disable
+escape hatch for the engine defaults.
+
 ### Reasoning effort (opt-in)
 
 `reasoning_effort` is an opt-in latency dial on the pipeline `llm` block, a

{agentic_dev_loop-0.10.2 → agentic_dev_loop-0.10.4}/tests/test_036_banned_commands_and_lane_boundary.py

@@ -48,34 +48,21 @@ def _export(tmp_path: Path, ws: Path) -> Path:
 
 class TestForbiddenCommandRules:
     def test_defaults_cover_deny_list(self):
-        rules = resolve_forbidden_rules([], network=False)
+        rules = resolve_forbidden_rules([])
         labels = [r.label for r in rules]
-        for expected in ("git commit", "git push", "git rebase", "git checkout",
-                         "git reset", "git tag", "npm install", "npm ci",
-                         "pip install", "uv add", "pip-compile",
-                         "dotnet add package", "npx playwright", "playwright",
-                         "docker", "dotnet restore", "dotnet add"):
-            assert expected in labels
-
-    def test_network_on_drops_network_gated_dotnet(self):
-        offline = resolve_forbidden_rules([], network=False)
-        online = resolve_forbidden_rules([], network=True)
-        assert "dotnet restore" in [r.label for r in offline]
-        assert "dotnet add" in [r.label for r in offline]
-        assert "dotnet restore" not in [r.label for r in online]
-        assert "dotnet add" not in [r.label for r in online]
+        assert labels == ['git commit', 'git push', 'git rebase', 'git checkout', 'git reset', 'git tag', 'docker']
 
     def test_custom_rules_append_with_pattern_label(self):
-        rules = resolve_forbidden_rules([r"rm\s+-rf"], network=False)
+        rules = resolve_forbidden_rules([r"rm\s+-rf"])
         assert rules[-1].label == r"rm\s+-rf"
 
     def test_shell_wrapped_argv_matches(self):
         argv = ["/bin/sh", "-c", "git push origin main"]
         assert match_forbidden_command(
-            argv, resolve_forbidden_rules([], network=False)) == "git push"
+            argv, resolve_forbidden_rules([])) == "git push"
 
     def test_empty_argv_never_matches(self):
-        assert match_forbidden_command([], resolve_forbidden_rules([], False)) is None
+        assert match_forbidden_command([], resolve_forbidden_rules([])) is None
 
 
 class TestSandboxTerminalDenyList:
@@ -86,7 +73,7 @@ class TestSandboxTerminalDenyList:
         from agentic_dev_loop.engine.agents import SandboxTerminalExecutor
         ex = SandboxTerminalExecutor(
             fake_sandbox, workspace=str(tmp_path), env={},
-            forbidden_commands=resolve_forbidden_rules([], network=False))
+            forbidden_commands=resolve_forbidden_rules([]))
         obs = ex(TerminalAction(command="git commit -m x"), None)
         assert "[forbidden: git commit]" in obs.text
         assert obs.exit_code is None
@@ -98,34 +85,11 @@ class TestSandboxTerminalDenyList:
         from agentic_dev_loop.engine.agents import SandboxTerminalExecutor
         ex = SandboxTerminalExecutor(
             fake_sandbox, workspace=str(tmp_path), env={},
-            forbidden_commands=resolve_forbidden_rules([r"rm\s+-rf"], False))
+            forbidden_commands=resolve_forbidden_rules([r"rm\s+-rf"]))
         obs = ex(TerminalAction(command="rm -rf /tmp/x"), None)
         assert "[forbidden: rm\\s+-rf]" in obs.text
         assert fake_sandbox.requests == []
 
-    def test_dotnet_restore_denied_offline(self, fake_sandbox, tmp_path):
-        from openhands.tools.terminal import TerminalAction
-
-        from agentic_dev_loop.engine.agents import SandboxTerminalExecutor
-        ex = SandboxTerminalExecutor(
-            fake_sandbox, workspace=str(tmp_path), env={},
-            forbidden_commands=resolve_forbidden_rules([], network=False))
-        obs = ex(TerminalAction(command="dotnet restore"), None)
-        assert "[forbidden: dotnet restore]" in obs.text
-        assert fake_sandbox.requests == []
-
-    def test_dotnet_restore_allowed_online(self, fake_sandbox, tmp_path):
-        from openhands.tools.terminal import TerminalAction
-
-        from agentic_dev_loop.engine.agents import SandboxTerminalExecutor
-        ex = SandboxTerminalExecutor(
-            fake_sandbox, workspace=str(tmp_path), env={}, network=True,
-            forbidden_commands=resolve_forbidden_rules([], network=True))
-        fake_sandbox.script(lambda req: (0, "restored", False))
-        obs = ex(TerminalAction(command="dotnet restore"), None)
-        assert obs.exit_code == 0
-        assert fake_sandbox.requests[0].argv == ["dotnet", "restore"]
-
 
 class TestPathAllowed:
     def test_literal_prefix(self):

{agentic_dev_loop-0.10.2 → agentic_dev_loop-0.10.4}/tests/test_055_recipes.py

@@ -47,6 +47,9 @@ def test_python_recipe_gate_set_and_commands():
     assert steps["qa"]["finalize_nudge_turns"] == 10
     assert "env" in steps["qa"]["verdicts"]
     assert "on_env" not in steps["qa"]
+    for name in ("brief", "dev", "review"):
+        assert steps[name]["forbidden_commands"] == ['pip install', 'uv add', 'pip-compile']
+    assert "forbidden_commands" not in steps["qa"]
 
 
 def test_dotnet_node_recipe_gate_set_and_commands():
@@ -69,6 +72,9 @@ def test_dotnet_node_recipe_gate_set_and_commands():
     assert steps["qa"]["env"] == {"PLAYWRIGHT_BROWSERS_PATH": "qa/.browsers"}
     assert steps["qa"]["mounts"] == [{"path": ".", "mode": "rw"}]
     assert len(doc["dev_impossible_set"]) == 4
+    for name in ("brief", "dev", "review"):
+        assert steps[name]["forbidden_commands"] == ['npm install', 'npm ci', 'dotnet add package', 'dotnet restore', 'dotnet add', 'npx playwright', 'playwright']
+    assert "forbidden_commands" not in steps["qa"]
 
 
 def test_unknown_recipe_raises():

{agentic_dev_loop-0.10.2 → agentic_dev_loop-0.10.4}/tests/test_aidlc.py

@@ -135,6 +135,21 @@ class TestResolveUnitDocs:
         assert not any("nfr-design" in k for k in docs)
         assert not any("unit-2" in k for k in docs)
 
+    def test_loads_bare_slug_code_generation_plan(self, tmp_path):
+        """`{slug}-code-generation-plan.md` (no infix) is the build spec -
+        the repo's actual plan filenames, e.g. unit-3-code-generation-plan.md,
+        must load, not only infixed variants like unit-3-scan-*."""
+        unit_dir = tmp_path / "construction" / "unit-3"
+        unit_dir.mkdir(parents=True)
+        (unit_dir / "design.md").write_text("# Design")
+        plans = tmp_path / "construction" / "plans"
+        plans.mkdir(parents=True)
+        (plans / "unit-3-code-generation-plan.md").write_text("# Build spec")
+
+        docs = resolve_unit_docs(tmp_path, "unit-3")
+
+        assert docs["plans/unit-3-code-generation-plan.md"] == "# Build spec"
+
     def test_missing_plans_dir_is_not_an_error(self, tmp_path):
         unit_dir = tmp_path / "construction" / "unit-2"
         unit_dir.mkdir(parents=True)

{agentic_dev_loop-0.10.2 → agentic_dev_loop-0.10.4}/tests/test_publish.py

@@ -264,79 +264,32 @@ class TestConsumerAdoption:
         assert proc.returncode == 0, proc.stderr
         assert read_version(repo) == "0.2.1"
 
-    def test_049_marker_without_adoption_section_fails(self, tmp_path):
-        """Plan 049 adds consumer pipeline obligations, so its slug must be
-        registered: a release entry referencing it without a
-        `### Consumer adoption` note gets refused."""
+    def test_dry_run_refuses_violating_entry(self, tmp_path):
+        """The dry run is the pre-cut gate: it runs the same refusal checks
+        as the real cut, so a violating entry is caught before anything is
+        written, committed, or tagged."""
         repo, _ = make_repo(
             tmp_path,
             unreleased=(
                 "### Changed\n\n"
-                "- feat: implement plan 049-native-brief-step-type\n"
-            ),
-        )
-        proc = run_publish(repo, "--patch")
-        assert proc.returncode != 0
-        assert "Consumer adoption" in proc.stderr
-        assert read_version(repo) == "0.2.0"
-        assert tags(repo) == []
-
-    def test_046_marker_without_adoption_section_fails(self, tmp_path):
-        """Plan 046 obligates consumers to delete the vendored brief prompt
-        and declare brief_inputs.sections, so its slug is registered too:
-        a release entry referencing it without a `### Consumer adoption`
-        note gets refused."""
-        repo, _ = make_repo(
-            tmp_path,
-            unreleased=(
-                "### Changed\n\n"
-                "- feat: tweak plan 046-embed-brief-prompt\n"
-            ),
-        )
-        proc = run_publish(repo, "--patch")
-        assert proc.returncode != 0
-        assert "Consumer adoption" in proc.stderr
-        assert read_version(repo) == "0.2.0"
-        assert tags(repo) == []
-
-    def test_054_marker_without_adoption_section_fails(self, tmp_path):
-        """Plan 054 flips reasoning passback to config-gated: pipelines
-        whose llm:/llms: entries point at a thinking model must set
-        reasoning_effort (absent effort now forwards nothing and raises a
-        D12 engine error), so its slug is registered: a release entry
-        referencing it without a `### Consumer adoption` note gets
-        refused."""
-        repo, _ = make_repo(
-            tmp_path,
-            unreleased=(
-                "### Changed\n\n"
-                "- feat: implement plan 054-per-step-model\n"
+                "- feat: construct plan 031-qa-environmental-verdict.md\n"
             ),
         )
-        proc = run_publish(repo, "--patch")
+        proc = run_publish(repo, "--patch", "--dry-run")
         assert proc.returncode != 0
         assert "Consumer adoption" in proc.stderr
         assert read_version(repo) == "0.2.0"
         assert tags(repo) == []
+        assert last_subject(repo) == "chore: initial"
 
-    def test_055_marker_without_adoption_section_fails(self, tmp_path):
-        """Plan 055 migrates consumer repos onto profiles and recipes
-        (profile key, trigger rewrite, isolation-block deletion), so its
-        slug is registered: a release entry referencing it without a
-        `### Consumer adoption` note gets refused."""
+    def test_dry_run_passes_violation_free_entry(self, tmp_path):
         repo, _ = make_repo(
             tmp_path,
-            unreleased=(
-                "### Changed\n\n"
-                "- feat: implement plan 055-consumer-onboarding-init-doctor\n"
-            ),
+            unreleased="### Changed\n\n- feat: add kernel sandbox\n",
         )
-        proc = run_publish(repo, "--patch")
-        assert proc.returncode != 0
-        assert "Consumer adoption" in proc.stderr
+        proc = run_publish(repo, "--patch", "--dry-run")
+        assert proc.returncode == 0, proc.stderr
         assert read_version(repo) == "0.2.0"
-        assert tags(repo) == []
-
 
 class TestGitOps:
     def test_commit_tag_and_push(self, tmp_path):