agentic-dev-loop 1.0.0a15__tar.gz → 1.0.0a16__tar.gz

{agentic_dev_loop-1.0.0a15 → agentic_dev_loop-1.0.0a16}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentic-dev-loop
-Version: 1.0.0a15
+Version: 1.0.0a16
 Summary: Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase.
 Author: Luke Wilson
 License-Expression: Apache-2.0
@@ -213,7 +213,7 @@ steps:
 | `on_pass:` / `on_fail:` | A step name, terminal `success`/`failure`, or `{goto: X, retry: true}`. No loops happen unless you write them. |
 | `env:` / `setup:` / `network:` | `env:` declares step vars (fixed safe base + declared vars only); `setup:` provisions the sandbox (command steps, network ON, stamp-cached); `network: true` grants egress to a command or agent step (default off) - see [Per-stage networking](#per-stage-networking). |
 | `secrets:` (top-level) / step `secrets:` | Declares secret **refs only - never values**; each step opts in to the refs it needs. Resolved host-side and injected into that step's exec env only. See [Secrets](#secrets--refs-only-never-values). |
-| `isolation:` (optional) | Configures the sandbox - image override, resource caps, `allow_git_mutations`. It can never disable it. |
+| `isolation:` (optional) | Configures the sandbox - image override, resource caps, `allow_git_mutations`, `seccomp_profile`. It can never disable it. See [browser sandbox](docs/browser-sandbox.md). |
 | `state_dir` | Defaults to `~/.agentic-dev-loop/runs/<pipeline-hash>/` - artifacts and checkpoints live outside the sandbox mount. |
 | `extensions_dir` | Where consumer `extensions:` modules resolve - defaults to `~/.agentic-dev-loop/extensions`, **outside** the workspace. Workspace-resident extension/tool modules are refused at load. |
 | `deps_policy` | `locked` (default) or `open`. `locked` = the human-owned lockfile is the source of truth and the agent may not add dependencies; `open` = the bootstrap protocol (the agent may add exact-pinned manifest entries). See [Dependency policy](#dependency-policy-locked-by-default). |

{agentic_dev_loop-1.0.0a15 → agentic_dev_loop-1.0.0a16}/README.md

@@ -171,7 +171,7 @@ steps:
 | `on_pass:` / `on_fail:` | A step name, terminal `success`/`failure`, or `{goto: X, retry: true}`. No loops happen unless you write them. |
 | `env:` / `setup:` / `network:` | `env:` declares step vars (fixed safe base + declared vars only); `setup:` provisions the sandbox (command steps, network ON, stamp-cached); `network: true` grants egress to a command or agent step (default off) - see [Per-stage networking](#per-stage-networking). |
 | `secrets:` (top-level) / step `secrets:` | Declares secret **refs only - never values**; each step opts in to the refs it needs. Resolved host-side and injected into that step's exec env only. See [Secrets](#secrets--refs-only-never-values). |
-| `isolation:` (optional) | Configures the sandbox - image override, resource caps, `allow_git_mutations`. It can never disable it. |
+| `isolation:` (optional) | Configures the sandbox - image override, resource caps, `allow_git_mutations`, `seccomp_profile`. It can never disable it. See [browser sandbox](docs/browser-sandbox.md). |
 | `state_dir` | Defaults to `~/.agentic-dev-loop/runs/<pipeline-hash>/` - artifacts and checkpoints live outside the sandbox mount. |
 | `extensions_dir` | Where consumer `extensions:` modules resolve - defaults to `~/.agentic-dev-loop/extensions`, **outside** the workspace. Workspace-resident extension/tool modules are refused at load. |
 | `deps_policy` | `locked` (default) or `open`. `locked` = the human-owned lockfile is the source of truth and the agent may not add dependencies; `open` = the bootstrap protocol (the agent may add exact-pinned manifest entries). See [Dependency policy](#dependency-policy-locked-by-default). |

{agentic_dev_loop-1.0.0a15 → agentic_dev_loop-1.0.0a16}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agentic-dev-loop"
-version = "1.0.0a15"
+version = "1.0.0a16"
 description = "Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase."
 readme = "README.md"
 requires-python = ">=3.12"

{agentic_dev_loop-1.0.0a15 → agentic_dev_loop-1.0.0a16}/src/agentic_dev_loop/core/config.py

@@ -87,11 +87,15 @@ class IsolationConfig(BaseModel):
     # the workspace - validated at startup, not load (the workspace is unknown
     # here).
     sandbox_venv_dir: str | None = None
-    # 023: optional host path to a Docker seccomp profile JSON. When set, the
-    # exec container runs with ``--security-opt seccomp=<path>`` in place of
-    # Docker's default profile. Used to allow Chromium's namespace sandbox
-    # (userns syscalls) under --cap-drop ALL. The path is validated by Docker
-    # at container-create time, not at load.
+    # 023/025: optional host path to a Docker seccomp profile JSON, or a
+    # ``bundled:<name>`` sentinel resolved at load to a packaged profile
+    # (e.g. ``bundled:chromium-userns``). When set, the exec container runs
+    # with ``--security-opt seccomp=<path>`` in place of Docker's default
+    # profile, plus ``--cap-add SYS_CHROOT`` (the profile gates chroot(2) on
+    # exactly that capability). Used to allow Chromium's namespace sandbox
+    # (userns syscalls) under --cap-drop ALL. An unknown sentinel name fails
+    # at load naming the known bundled profiles; a raw path is validated by
+    # Docker at container-create time, not at load.
     seccomp_profile: str | None = None
 
     @field_validator("memory")

{agentic_dev_loop-1.0.0a15 → agentic_dev_loop-1.0.0a16}/src/agentic_dev_loop/engine/dryrun.py

@@ -16,7 +16,7 @@ from agentic_dev_loop.core.config import PipelineConfig, StepConfig, load_config
 from .hostboundary import check_orchestrator_install, check_tooling_integrity
 from .loaders import resolve_docs
 from .isolation import (isolation_state_dir, resolve_effective_profile,
-                        resolve_image_ref)
+                        resolve_image_ref, resolved_seccomp_profile)
 from .registry import (Registry, default_registry, load_extensions,
                        validate_action_network)
 from .secrets import scan_env_files
@@ -134,6 +134,7 @@ def dry_run(cfg_path, args, registry: Registry | None = None) -> int:
 
     _validate_agents(cfg, base / cfg.agents_dir)
     _validate_actions(cfg, registry)
+    resolved_seccomp_profile(cfg)  # fails loud on an unknown bundled:<name>
 
     loader, docs, subject = resolve_docs(cfg, base, registry, args)
     image, memory, cpus = _resolved_image(cfg)

{agentic_dev_loop-1.0.0a15 → agentic_dev_loop-1.0.0a16}/src/agentic_dev_loop/engine/isolation.py

@@ -37,6 +37,7 @@ from typing import Protocol
 
 from agentic_dev_loop.core.config import IsolationConfig, PipelineConfig
 from .proc import needs_shell, split_command
+from .seccomp import resolve_seccomp_profile
 
 # ---------------------------------------------------------------------------
 # Constants (KD-2 / ID-4)
@@ -480,7 +481,9 @@ def docker_create_payload(*, run_id: str, image: str, profile: EffectiveProfile,
     CAP_SYS_CHROOT; the profile gates chroot(2) on exactly that capability,
     so the payload adds it back (the bounding set is otherwise empty under
     --cap-drop ALL). Without the cap the zygote dies even with the profile
-    (023 host-side gate 2)."""
+    (023 host-side gate 2). The ``--cap-add SYS_CHROOT`` applies to any
+    seccomp profile by design: the bundled profile requires it, and custom
+    profiles are expected to follow the same cap-gated pattern."""
     payload = [
         "docker", "run", "--detach", "--rm", "--name",
         exec_container_name(run_id, network),
@@ -956,6 +959,14 @@ def isolation_state_dir(cfg: PipelineConfig) -> Path:
     return Path(iso.state_dir).expanduser()
 
 
+def resolved_seccomp_profile(cfg: PipelineConfig) -> str | None:
+    """The pipeline's seccomp profile with any ``bundled:<name>`` sentinel
+    expanded to a real host path (025). A raw path passes through unchanged
+    and is still validated by Docker at container-create time."""
+    return resolve_seccomp_profile(
+        cfg.isolation.seccomp_profile if cfg.isolation else None)
+
+
 def resolve_image_ref(image: str, environ: Mapping[str, str] | None = None) -> str:
     """AGENTIC_DEV_LOOP_DEV_IMAGE override (tag OR digest) → else the profile
     image (digest-pinned) → if empty, fail fast AE-SBX-005."""
@@ -976,6 +987,7 @@ def startup_sandbox(cfg: PipelineConfig, *, workspace: Path,
                     refresh: bool | None = None) -> Sandbox:
     """Eager startup sequence (Q2): probe → image → backend → ensure_image →
     create+start → pre-provision every declared setup (stamp-cached)."""
+    seccomp_profile = resolved_seccomp_profile(cfg)
     probe_docker(runner)
     profile = resolve_effective_profile(cfg.isolation)
     image = resolve_image_ref(profile.image)
@@ -983,7 +995,6 @@ def startup_sandbox(cfg: PipelineConfig, *, workspace: Path,
     needs_network = any(step.network for step in cfg.steps)
     sandbox_venv_dir = resolve_sandbox_venv_dir(
         cfg.isolation.sandbox_venv_dir if cfg.isolation else None, workspace)
-    seccomp_profile = cfg.isolation.seccomp_profile if cfg.isolation else None
     backend = DockerBackend(
         image=image, workspace=str(workspace), iso_state_dir=str(iso_state_dir),
         profile=profile, runner=runner, network=needs_network,

agentic_dev_loop-1.0.0a16/src/agentic_dev_loop/engine/seccomp/__init__.py

@@ -0,0 +1,72 @@
+"""Bundled Docker seccomp profiles (023).
+
+Docker's default seccomp profile blocks the user-namespace syscalls Chromium's
+namespace sandbox needs, which makes ``chromium.launch(chromiumSandbox=True)``
+die at the zygote under ``--cap-drop ALL``. These profiles are Docker's default
+profile with an allowlist for those userns syscalls; pass one as
+``isolation.seccomp_profile`` to swap it in. The ``bundled:<name>`` sentinel
+(025) resolves a profile by name so consumers declare intent instead of
+rediscovering the packaged path.
+"""
+
+from __future__ import annotations
+
+from importlib.resources import as_file, files
+
+CHROMIUM_USERNS_NAME = "chromium-userns"
+CHROMIUM_USERNS_PROFILE = "chromium-userns.json"
+
+# ``bundled:<name>`` sentinel suffix -> packaged JSON filename. This is the
+# single registry new bundled profiles slot into (025).
+BUNDLED_PROFILES = {
+    CHROMIUM_USERNS_NAME: CHROMIUM_USERNS_PROFILE,
+}
+
+
+def _profile_path(filename: str) -> str:
+    """Host filesystem path to a packaged seccomp profile JSON."""
+    traversable = files("agentic_dev_loop.engine.seccomp").joinpath(filename)
+    with as_file(traversable) as path:
+        return str(path)
+
+
+def bundled_profile_path(name: str) -> str:
+    """Host filesystem path to the named bundled seccomp profile.
+
+    Raises ``ValueError`` listing every known ``bundled:<name>`` when ``name``
+    is unknown, so a bad sentinel fails loud at load instead of at
+    container-create time.
+    """
+    filename = BUNDLED_PROFILES.get(name)
+    if filename is None:
+        known = ", ".join(f"bundled:{n}" for n in sorted(BUNDLED_PROFILES))
+        raise ValueError(
+            f"unknown bundled seccomp profile {name!r} (known: {known})")
+    return _profile_path(filename)
+
+
+def chromium_userns_profile_path() -> str:
+    """Host filesystem path to the bundled Chromium userns seccomp profile.
+
+    Docker's ``--security-opt seccomp=<path>`` takes a host path, so the JSON
+    must resolve to a real file. Wheels unpack to disk, so ``as_file`` returns
+    the installed path without copying.
+    """
+    return bundled_profile_path(CHROMIUM_USERNS_NAME)
+
+
+def resolve_seccomp_profile(value: str | None) -> str | None:
+    """Expand a ``bundled:<name>`` sentinel to its real profile path (025).
+
+    A raw host path passes through unchanged (Docker still validates it at
+    container-create time, unchanged from 023). An unknown or empty bundled
+    name fails loud with every known ``bundled:<name>``.
+    """
+    if value is None or not value.startswith("bundled:"):
+        return value
+    name = value[len("bundled:"):]
+    if not name:
+        known = ", ".join(f"bundled:{n}" for n in sorted(BUNDLED_PROFILES))
+        raise ValueError(
+            f"seccomp_profile 'bundled:' is missing a name (known: {known})")
+    return bundled_profile_path(name)

{agentic_dev_loop-1.0.0a15 → agentic_dev_loop-1.0.0a16}/src/agentic_dev_loop.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentic-dev-loop
-Version: 1.0.0a15
+Version: 1.0.0a16
 Summary: Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase.
 Author: Luke Wilson
 License-Expression: Apache-2.0
@@ -213,7 +213,7 @@ steps:
 | `on_pass:` / `on_fail:` | A step name, terminal `success`/`failure`, or `{goto: X, retry: true}`. No loops happen unless you write them. |
 | `env:` / `setup:` / `network:` | `env:` declares step vars (fixed safe base + declared vars only); `setup:` provisions the sandbox (command steps, network ON, stamp-cached); `network: true` grants egress to a command or agent step (default off) - see [Per-stage networking](#per-stage-networking). |
 | `secrets:` (top-level) / step `secrets:` | Declares secret **refs only - never values**; each step opts in to the refs it needs. Resolved host-side and injected into that step's exec env only. See [Secrets](#secrets--refs-only-never-values). |
-| `isolation:` (optional) | Configures the sandbox - image override, resource caps, `allow_git_mutations`. It can never disable it. |
+| `isolation:` (optional) | Configures the sandbox - image override, resource caps, `allow_git_mutations`, `seccomp_profile`. It can never disable it. See [browser sandbox](docs/browser-sandbox.md). |
 | `state_dir` | Defaults to `~/.agentic-dev-loop/runs/<pipeline-hash>/` - artifacts and checkpoints live outside the sandbox mount. |
 | `extensions_dir` | Where consumer `extensions:` modules resolve - defaults to `~/.agentic-dev-loop/extensions`, **outside** the workspace. Workspace-resident extension/tool modules are refused at load. |
 | `deps_policy` | `locked` (default) or `open`. `locked` = the human-owned lockfile is the source of truth and the agent may not add dependencies; `open` = the bootstrap protocol (the agent may add exact-pinned manifest entries). See [Dependency policy](#dependency-policy-locked-by-default). |

{agentic_dev_loop-1.0.0a15 → agentic_dev_loop-1.0.0a16}/tests/test_isolation.py

@@ -1097,6 +1097,54 @@ class TestStartupSandbox:
         finally:
             sandbox.close()
 
+    def test_bundled_seccomp_sentinel_resolved_and_plumbed(self, tmp_path, monkeypatch):
+        """025: a ``bundled:chromium-userns`` sentinel is expanded to the real
+        packaged path before the exec payload is built, so the payload sees a
+        plain path and emits the profile plus the cap-gated SYS_CHROOT add."""
+        from agentic_dev_loop.engine.isolation import startup_sandbox
+        from agentic_dev_loop.engine.seccomp import chromium_userns_profile_path
+
+        ws = tmp_path / "ws"
+        ws.mkdir()
+        cfg = self._cfg(tmp_path, with_setup=False)
+        cfg.isolation.seccomp_profile = "bundled:chromium-userns"
+        monkeypatch.setattr("agentic_dev_loop.engine.isolation.shutil.which",
+                            lambda *a: "/usr/bin/docker")
+        monkeypatch.setenv("AGENTIC_DEV_LOOP_DEV_IMAGE", "img:tag")
+        runner = FakeRunner(
+            ok("1.54"),   # probe version
+            ok("linux"),  # probe ostype
+            ok(""),       # image inspect
+            ok(""),       # docker run -d --rm (exec container)
+        )
+        sandbox = startup_sandbox(cfg, workspace=ws, runner=runner)
+        try:
+            run_argv = [c for c in runner.calls if c[:2] == ["docker", "run"]][0]
+            resolved = chromium_userns_profile_path()
+            assert "--security-opt" in run_argv
+            assert run_argv[run_argv.index("--security-opt") + 1] == f"seccomp={resolved}"
+            assert "--cap-add" in run_argv
+            assert run_argv[run_argv.index("--cap-add") + 1] == "SYS_CHROOT"
+        finally:
+            sandbox.close()
+
+    def test_unknown_bundled_seccomp_name_fails_before_docker_probe(self, tmp_path, monkeypatch):
+        """025: an unknown bundled:<name> fails loud at startup, before any
+        Docker probe runs."""
+        from agentic_dev_loop.engine.isolation import startup_sandbox
+
+        ws = tmp_path / "ws"
+        ws.mkdir()
+        cfg = self._cfg(tmp_path, with_setup=False)
+        cfg.isolation.seccomp_profile = "bundled:unknown-name"
+        monkeypatch.setattr("agentic_dev_loop.engine.isolation.shutil.which",
+                            lambda *a: "/usr/bin/docker")
+        monkeypatch.setenv("AGENTIC_DEV_LOOP_DEV_IMAGE", "img:tag")
+        runner = FakeRunner()
+        with pytest.raises(ValueError, match="bundled:chromium-userns"):
+            startup_sandbox(cfg, workspace=ws, runner=runner)
+        assert runner.calls == []
+
     def test_in_workspace_sandbox_venv_dir_fails_loud(self, tmp_path, monkeypatch):
         from agentic_dev_loop.engine.isolation import startup_sandbox
 
@@ -1155,3 +1203,60 @@ class TestBundledSeccompProfile:
         path = Path(chromium_userns_profile_path())
         assert path.is_file()
         assert json.loads(path.read_text(encoding="utf-8"))["defaultAction"]             == "SCMP_ACT_ERRNO"
+
+
+class TestResolveSeccompProfile:
+    """025: the ``bundled:<name>`` sentinel resolves to a packaged profile
+    path; raw host paths pass through unchanged; unknown names fail loud with
+    every known bundled name."""
+
+    def test_bundled_sentinel_resolves_to_real_path(self):
+        from agentic_dev_loop.engine.seccomp import (chromium_userns_profile_path,
+                                                     resolve_seccomp_profile)
+
+        resolved = resolve_seccomp_profile("bundled:chromium-userns")
+        assert resolved == chromium_userns_profile_path()
+        assert Path(resolved).is_file()
+
+    def test_unknown_bundled_name_lists_known(self):
+        from agentic_dev_loop.engine.seccomp import resolve_seccomp_profile
+
+        with pytest.raises(ValueError, match="bundled:chromium-userns"):
+            resolve_seccomp_profile("bundled:unknown-name")
+
+    def test_empty_bundled_name_lists_known(self):
+        from agentic_dev_loop.engine.seccomp import resolve_seccomp_profile
+
+        with pytest.raises(ValueError, match="bundled:chromium-userns"):
+            resolve_seccomp_profile("bundled:")
+
+    def test_none_passes_through(self):
+        from agentic_dev_loop.engine.seccomp import resolve_seccomp_profile
+
+        assert resolve_seccomp_profile(None) is None
+
+    def test_raw_path_passes_through(self):
+        from agentic_dev_loop.engine.seccomp import resolve_seccomp_profile
+
+        assert resolve_seccomp_profile(
+            "/host/chromium-userns.json") == "/host/chromium-userns.json"
+
+    def test_bundled_profile_path_unknown_name(self):
+        from agentic_dev_loop.engine.seccomp import bundled_profile_path
+
+        with pytest.raises(ValueError, match="bundled:chromium-userns"):
+            bundled_profile_path("nope")
+
+    def test_sentinel_resolves_into_payload(self):
+        """025: the resolved sentinel path reaches ``docker_create_payload``
+        unchanged, producing the profile security-opt and the cap-add."""
+        from agentic_dev_loop.engine.seccomp import resolve_seccomp_profile
+
+        resolved = resolve_seccomp_profile("bundled:chromium-userns")
+        payload = docker_create_payload(
+            run_id="r1", image="img",
+            profile=EffectiveProfile(True, True, True, True, True,
+                                     "img", "4g", 2.0),
+            workspace="/ws", seccomp_profile=resolved)
+        assert payload[payload.index("--security-opt") + 1] == f"seccomp={resolved}"
+        assert payload[payload.index("--cap-add") + 1] == "SYS_CHROOT"

agentic_dev_loop-1.0.0a15/src/agentic_dev_loop/engine/seccomp/__init__.py

@@ -1,27 +0,0 @@
-"""Bundled Docker seccomp profiles (023).
-
-Docker's default seccomp profile blocks the user-namespace syscalls Chromium's
-namespace sandbox needs, which makes ``chromium.launch(chromiumSandbox=True)``
-die at the zygote under ``--cap-drop ALL``. These profiles are Docker's default
-profile with an allowlist for those userns syscalls; pass one as
-``isolation.seccomp_profile`` to swap it in.
-"""
-
-from __future__ import annotations
-
-from importlib.resources import as_file, files
-
-CHROMIUM_USERNS_PROFILE = "chromium-userns.json"
-
-
-def chromium_userns_profile_path() -> str:
-    """Host filesystem path to the bundled Chromium userns seccomp profile.
-
-    Docker's ``--security-opt seccomp=<path>`` takes a host path, so the JSON
-    must resolve to a real file. Wheels unpack to disk, so ``as_file`` returns
-    the installed path without copying.
-    """
-    traversable = files("agentic_dev_loop.engine.seccomp").joinpath(
-        CHROMIUM_USERNS_PROFILE)
-    with as_file(traversable) as path:
-        return str(path)