agentic-dev-loop 1.0.0a18__tar.gz → 1.0.0a20__tar.gz

{agentic_dev_loop-1.0.0a18/src/agentic_dev_loop.egg-info → agentic_dev_loop-1.0.0a20}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentic-dev-loop
-Version: 1.0.0a18
+Version: 1.0.0a20
 Summary: Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase.
 Author: Luke Wilson
 License-Expression: Apache-2.0

{agentic_dev_loop-1.0.0a18 → agentic_dev_loop-1.0.0a20}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agentic-dev-loop"
-version = "1.0.0a18"
+version = "1.0.0a20"
 description = "Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase."
 readme = "README.md"
 requires-python = ">=3.12"

{agentic_dev_loop-1.0.0a18 → agentic_dev_loop-1.0.0a20}/src/agentic_dev_loop/engine/egress_proxy.py

@@ -131,6 +131,13 @@ class EgressProxy:
             _write(writer, b"HTTP/1.1 403 Forbidden\r\nContent-Length: 0\r\n\r\n")
             return
         self._record(host, True)
+        # Drain the rest of the CONNECT request (the header block after the
+        # request line). Clients send the whole request in one write, so the
+        # headers are already buffered here; relaying them to the upstream as
+        # if they were the first tunnel bytes corrupts the TLS handshake (the
+        # upstream answers with a decode alert - the restore step's SSL
+        # TLSV1_ALERT_DECODE_ERROR).
+        await _drain_headers(reader)
         conn = await _open(host, port)
         if conn is None:
             _write(writer, b"HTTP/1.1 502 Bad Gateway\r\nContent-Length: 0\r\n\r\n")
@@ -222,6 +229,16 @@ async def _forward_headers(reader, upstream, host: str) -> None:
     await upstream.drain()
 
 
+async def _drain_headers(reader) -> None:
+    """Consume a request's header block (the lines after the request line,
+    terminated by a blank line). The CONNECT path must not forward these to
+    the upstream tunnel - only the post-200 bytes belong there."""
+    while True:
+        line = await reader.readline()
+        if not line or line in (b"\r\n", b"\n"):
+            break
+
+
 async def _relay_both(client_reader, client_writer, upstream_reader,
                       upstream_writer) -> None:
     await asyncio.gather(

{agentic_dev_loop-1.0.0a18 → agentic_dev_loop-1.0.0a20}/src/agentic_dev_loop/engine/isolation.py

@@ -1271,16 +1271,20 @@ def resolve_image_ref(image: str, environ: Mapping[str, str] | None = None) -> s
 
 
 def startup_sandbox(cfg: PipelineConfig, *, workspace: Path,
+                    state_dir: str | Path,
                     runner: CommandRunner | None = None,
-                    refresh: bool | None = None,
-                    state_dir: str | Path | None = None) -> Sandbox:
+                    refresh: bool | None = None) -> Sandbox:
     """Eager startup sequence (Q2): probe → image → materialise export →
     backend → ensure_image → create+start → pre-provision every declared setup
     (stamp-cached).
 
     ``state_dir`` (the run state dir) hosts the .git-free export under
-    ``exports/<run-id>/``, materialised here (BR-2/BR-3); when omitted the
-    legacy workspace model applies (integration tests, programmatic calls)."""
+    ``exports/<run-id>/``, materialised here (BR-2/BR-3). It is required:
+    the runtime always resolves a mount set for steps, and enforcement needs
+    the export (AE-SBX-017), so there is no legacy fallback through this
+    entry point. The legacy workspace model is reachable only through the
+    direct Sandbox API (DockerBackend without an export + requests carrying
+    ``mount_set=None``), which is integration-tests-only."""
     seccomp_profile = resolved_seccomp_profile(cfg)
     probe_docker(runner)
     profile = resolve_effective_profile(cfg.isolation)
@@ -1290,16 +1294,13 @@ def startup_sandbox(cfg: PipelineConfig, *, workspace: Path,
     sandbox_venv_dir = resolve_sandbox_venv_dir(
         cfg.isolation.sandbox_venv_dir if cfg.isolation else None, workspace)
 
-    export_root: str | None = None
-    cache_mounts: list[tuple[str, str, str]] | None = None
-    if state_dir is not None:
-        export_root = str(Path(state_dir) / "exports" / uuid.uuid4().hex)
-        cache_paths = discover_cache_paths(workspace, sandbox_venv_dir)
-        ws = StepWorkspace.materialise(
-            workspace, cache_paths, sys.platform, export_root,
-            state_dir=str(state_dir))
-        export_root = str(ws.export_root)
-        cache_mounts = ws.mount_points()[1:]  # skip the export root itself
+    export_root = str(Path(state_dir) / "exports" / uuid.uuid4().hex)
+    cache_paths = discover_cache_paths(workspace, sandbox_venv_dir)
+    ws = StepWorkspace.materialise(
+        workspace, cache_paths, sys.platform, export_root,
+        state_dir=str(state_dir))
+    export_root = str(ws.export_root)
+    cache_mounts = ws.mount_points()[1:]  # skip the export root itself
 
     backend = DockerBackend(
         image=image, workspace=str(workspace), iso_state_dir=str(iso_state_dir),

{agentic_dev_loop-1.0.0a18 → agentic_dev_loop-1.0.0a20}/src/agentic_dev_loop/engine/step_workspace.py

@@ -140,7 +140,7 @@ class StepWorkspace:
             src = repo / rel
             dst = self._export_root / rel
             dst.parent.mkdir(parents=True, exist_ok=True)
-            shutil.copy2(src, dst)
+            shutil.copy2(src, dst, follow_symlinks=False)
         for cache in self._plan.cache_mounts:
             (self._export_root / cache.relative).mkdir(parents=True,
                                                        exist_ok=True)

{agentic_dev_loop-1.0.0a18 → agentic_dev_loop-1.0.0a20}/src/agentic_dev_loop/engine/sync_back.py

@@ -105,6 +105,12 @@ def plan_sync_back(export_changes: Mapping[str, str],
 
 
 def _digest(path: Path) -> str:
+    if path.is_symlink():
+        # Track the link target, never the resolved content: the export can
+        # legitimately hold dangling symlinks (host-darwin venv entries,
+        # scratch links) and resolving them against the host would crash.
+        return "link:" + hashlib.sha256(
+            os.readlink(path).encode("utf-8")).hexdigest()
     return hashlib.sha256(path.read_bytes()).hexdigest()
 
 
@@ -112,7 +118,9 @@ def _snapshot(root: Path,
               cache_paths: list[str] | tuple[str, ...] = ()) -> dict[str, str]:
     """rel-path -> sha256 for every file under root, excluding ``.git``,
     host-only dirs, and declared caches (BR-3: caches are bind-mounted, not
-    copied, so their contents are never part of the export)."""
+    copied, so their contents are never part of the export). Symlinks are
+    tracked by their link target (never resolved against the host), so
+    dangling links snapshot fine."""
     cache = [_parts(c) for c in cache_paths]
     out: dict[str, str] = {}
     for dirpath, dirnames, filenames in os.walk(root):
@@ -180,7 +188,7 @@ def sync_back(export_root: str | Path, real_repo: str | Path,
         src = export_root / rel
         dst = real_repo / rel
         dst.parent.mkdir(parents=True, exist_ok=True)
-        shutil.copy2(src, dst)
+        shutil.copy2(src, dst, follow_symlinks=False)
     for rel in plan.to_delete:
         (real_repo / rel).unlink(missing_ok=True)
 

{agentic_dev_loop-1.0.0a18 → agentic_dev_loop-1.0.0a20/src/agentic_dev_loop.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentic-dev-loop
-Version: 1.0.0a18
+Version: 1.0.0a20
 Summary: Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase.
 Author: Luke Wilson
 License-Expression: Apache-2.0

{agentic_dev_loop-1.0.0a18 → agentic_dev_loop-1.0.0a20}/tests/test_egress_proxy.py

@@ -5,6 +5,7 @@ unmatched hostname is denied and logged as an enforcement event (BR-6)."""
 import http.server
 import socket
 import threading
+import time
 
 import pytest
 
@@ -126,3 +127,79 @@ def test_connect_port_constraint_matches_exact_port():
             p.stop()
     finally:
         server.shutdown()
+
+
+class _RawTcpServer:
+    """A bare TCP listener that records every byte it receives."""
+
+    def __init__(self):
+        self.sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        self.sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+        self.sock.bind(("127.0.0.1", 0))
+        self.sock.listen(1)
+        self.port = self.sock.getsockname()[1]
+        self.received = bytearray()
+        self._thread = threading.Thread(target=self._accept, daemon=True)
+        self._thread.start()
+
+    def _accept(self):
+        try:
+            conn, _ = self.sock.accept()
+        except OSError:
+            return
+        with conn:
+            conn.settimeout(5.0)
+            while True:
+                try:
+                    chunk = conn.recv(65536)
+                except socket.timeout:
+                    break
+                if not chunk:
+                    break
+                self.received.extend(chunk)
+
+    def close(self):
+        try:
+            self.sock.close()
+        except OSError:
+            pass
+
+
+def test_connect_headers_drained_not_tunnelled():
+    """The CONNECT request's header block must be consumed by the proxy, not
+    relayed into the tunnel. Clients send the request line, headers and the
+    first TLS bytes in one write; leaking the headers corrupts the handshake
+    (the upstream answers with a TLS decode alert)."""
+    upstream = _RawTcpServer()
+    try:
+        policy = EgressPolicy(targets=(TargetEntry(host="127.0.0.1"),))
+        p = EgressProxy(policy=policy)
+        p.start()
+        try:
+            tls_bytes = b"\x16\x03\x01" + b"post-200-bytes"
+            payload = (
+                f"CONNECT 127.0.0.1:{upstream.port} HTTP/1.1\r\n"
+                "Host: 127.0.0.1\r\n"
+                "User-Agent: pip\r\n"
+                "Proxy-Connection: keep-alive\r\n"
+                "\r\n"
+            ).encode("latin-1") + tls_bytes
+            with socket.create_connection(("127.0.0.1", p._port), timeout=5.0) as s:
+                s.sendall(payload)
+                s.settimeout(5.0)
+                buf = b""
+                while b"\r\n\r\n" not in buf:
+                    chunk = s.recv(65536)
+                    if not chunk:
+                        break
+                    buf += chunk
+            assert b"200 Connection Established" in buf
+            deadline = time.monotonic() + 5.0
+            while (time.monotonic() < deadline
+                   and len(upstream.received) < len(tls_bytes)):
+                time.sleep(0.05)
+            assert bytes(upstream.received) == tls_bytes
+        finally:
+            p.stop()
+    finally:
+        upstream.close()

{agentic_dev_loop-1.0.0a18 → agentic_dev_loop-1.0.0a20}/tests/test_hostboundary_integration.py

@@ -5,6 +5,7 @@ never silently skipped in CI."""
 from __future__ import annotations
 
 import shutil
+from pathlib import Path
 
 import pytest
 from openhands.sdk import LLM
@@ -16,6 +17,7 @@ from agentic_dev_loop.engine.isolation import (
 )
 from agentic_dev_loop.engine.registry import Registry
 from agentic_dev_loop.engine.stages import Runtime, make_action_node
+from agentic_dev_loop.engine.step_workspace import StepWorkspace
 
 pytestmark = pytest.mark.docker
 
@@ -44,16 +46,24 @@ def backend(tmp_path):
         pytest.skip(f"integration image {TEST_IMAGE!r} not present locally")
     ws = tmp_path / "ws"
     ws.mkdir()
+    # unit-5: every step resolves a mount set, so enforcement needs the
+    # materialised .git-free export (AE-SBX-017 otherwise). Wire the export
+    # the way startup_sandbox does (mirror test_isolation_integration's
+    # _export_backend).
+    export = tmp_path / "state" / "exports" / "r1"
+    ws_obj = StepWorkspace.materialise(ws, [], "linux", export)
     profile = resolve_effective_profile(IsolationConfig(image=TEST_IMAGE))
     b = DockerBackend(image=TEST_IMAGE, workspace=str(ws),
-                      iso_state_dir=str(tmp_path / "state"), profile=profile)
+                      iso_state_dir=str(tmp_path / "state"), profile=profile,
+                      export_root=str(export),
+                      cache_mounts=ws_obj.mount_points()[1:])
     b.ensure_image()
     b.create_execution_container()
-    yield b, ws
+    yield b, ws, export
     b.close()
 
 
-def _runtime(backend, ws, script, tmp_path):
+def _runtime(backend, ws, export, script, tmp_path):
     reg = Registry()
     reg.add_sandbox_action("probe", script)
     cfg = PipelineConfig.model_validate({
@@ -61,32 +71,43 @@ def _runtime(backend, ws, script, tmp_path):
         "llm": {"model": "openai/test-model", "api_key_env": "K"},
         "agents_dir": "agents",
         "lockfiles": ["uv.lock"],
-        "steps": [{"name": "probe", "action": "probe", "on_pass": "success"}],
+        # The workspace is a declared-rw mount (BR-1.2): the consumer can
+        # write inside the sandbox, and sync-back (BR-4) carries it to ws.
+        "steps": [{"name": "probe", "action": "probe", "on_pass": "success",
+                   "mounts": [{"path": ".", "mode": "rw"}]}],
     })
     runtime = Runtime(cfg=cfg, registry=reg,
                       llm=LLM(model="openai/test-model", api_key="sk-test"),
                       agents_dir=tmp_path / "agents", state_dir=tmp_path / "state",
-                      workspace=ws, sandbox=backend)
+                      workspace=ws, sandbox=backend, sandbox_cwd=Path(export))
     return runtime, cfg.steps[0]
 
 
 class TestConsumerActionSentinel:
     def test_action_code_cannot_create_host_file(self, backend, tmp_path):
-        b, ws = backend
+        b, ws, export = backend
         sentinel = tmp_path / "host-sentinel.txt"
-        script = f'python -c "open({str(sentinel)!r}, \\"w\\").write(\\"pwned\\")"'
-        runtime, step = _runtime(b, ws, script, tmp_path)
-        node = make_action_node(runtime, step)
-        node({"subject": "s", "attempt": 1, "step_verdicts": {}})
-        # The action wrote to a path that exists on the host but is not the
-        # workspace mount - it landed in the container's own filesystem (or was
-        # refused by the read-only rootfs), never on the host.
+        # The marker is written first: it proves the consumer code really ran
+        # inside the sandbox, so this test can never pass vacuously when the
+        # action dies pre-exec. Then the escape attempt.
+        script = (f'python -c "open(\\"ran-in-sandbox.txt\\", \\"w\\").write(\\"ran\\"); '
+                  f'open({str(sentinel)!r}, \\"w\\").write(\\"pwned\\")"')
+        runtime, step = _runtime(b, ws, export, script, tmp_path)
+        make_action_node(runtime, step)({"subject": "s", "attempt": 1,
+                                         "step_verdicts": {}})
+        # The escape attempt targets a path that exists on the host but is not
+        # the export mount: the container never sees it, so it fails inside
+        # the container (or lands in its own filesystem), never on the host.
+        assert (ws / "ran-in-sandbox.txt").read_text() == "ran"
         assert not sentinel.exists()
 
     def test_action_can_still_write_inside_workspace(self, backend, tmp_path):
-        b, ws = backend
+        b, ws, export = backend
         script = 'python -c "open(\\"in-sandbox.txt\\", \\"w\\").write(\\"ok\\")"'
-        runtime, step = _runtime(b, ws, script, tmp_path)
-        make_action_node(runtime, step)({"subject": "s", "attempt": 1,
-                                         "step_verdicts": {}})
+        runtime, step = _runtime(b, ws, export, script, tmp_path)
+        update = make_action_node(runtime, step)({"subject": "s", "attempt": 1,
+                                                  "step_verdicts": {}})
+        # The action genuinely executed (verdict pass) and its declared-rw
+        # write synced back to the real workspace (BR-4).
+        assert update["step_verdicts"]["probe"] == "pass"
         assert (ws / "in-sandbox.txt").read_text() == "ok"

{agentic_dev_loop-1.0.0a18 → agentic_dev_loop-1.0.0a20}/tests/test_isolation.py

@@ -975,6 +975,24 @@ class TestStartupSandbox:
             "isolation": {"state_dir": str(tmp_path / "iso-state")},
         })
 
+    def test_state_dir_required(self, tmp_path, monkeypatch):
+        """The run state_dir is mandatory: the runtime always resolves a
+        mount set for steps, so enforcement needs the materialised export
+        (AE-SBX-017). Omitting state_dir fails at the call - never silently
+        degrades to the legacy workspace model."""
+        from agentic_dev_loop.engine.isolation import startup_sandbox
+
+        ws = tmp_path / "ws"
+        ws.mkdir()
+        cfg = self._cfg(tmp_path)
+        monkeypatch.setattr("agentic_dev_loop.engine.isolation.shutil.which",
+                            lambda *a: "/usr/bin/docker")
+        monkeypatch.setenv("AGENTIC_DEV_LOOP_DEV_IMAGE", "img:tag")
+        runner = FakeRunner()
+        with pytest.raises(TypeError, match="state_dir"):
+            startup_sandbox(cfg, workspace=ws, runner=runner)  # type: ignore[call-arg]
+        assert runner.calls == []
+
     def test_sequence_and_provision(self, tmp_path, monkeypatch):
         from agentic_dev_loop.engine import isolation
         from agentic_dev_loop.engine.isolation import startup_sandbox
@@ -992,7 +1010,7 @@ class TestStartupSandbox:
             ok(""),               # docker run -d --rm (exec container)
             ok(""),               # docker run provision
         )
-        sandbox = startup_sandbox(cfg, workspace=ws, runner=runner)
+        sandbox = startup_sandbox(cfg, workspace=ws, state_dir=tmp_path / "run-state", runner=runner)
         try:
             kinds = [c[1] for c in runner.calls]
             assert kinds == ["version", "info", "image", "run", "run"]
@@ -1006,9 +1024,10 @@ class TestStartupSandbox:
             sandbox.close()
 
     def test_network_declaration_starts_second_container(self, tmp_path, monkeypatch):
-        """014: declaring `network: true` on any step makes eager startup
-        create the bridge-network container in addition to the default
-        network-none one - the default (no declaration) stays single-container."""
+        """014/unit-5: startup creates only the base network-none export
+        container. The bridge-network container for a network-declaring step
+        starts lazily in the profile pool on the first networked request
+        (covered by test_isolation_integration), never eagerly at startup."""
         from agentic_dev_loop.core.config import PipelineConfig
         from agentic_dev_loop.engine.isolation import startup_sandbox
 
@@ -1030,15 +1049,13 @@ class TestStartupSandbox:
             ok("1.54"),           # probe version
             ok("linux"),          # probe ostype
             ok(""),               # image inspect
-            ok(""),               # docker run -d --rm (network-none exec)
-            ok(""),               # docker run -d --rm (networked exec)
+            ok(""),               # docker run -d --rm (base export container)
         )
-        sandbox = startup_sandbox(cfg, workspace=ws, runner=runner)
+        sandbox = startup_sandbox(cfg, workspace=ws, state_dir=tmp_path / "run-state", runner=runner)
         try:
             run_argv = [c for c in runner.calls if c[1] == "run"]
-            assert len(run_argv) == 2
+            assert len(run_argv) == 1
             assert "--network" in run_argv[0] and "none" in run_argv[0]
-            assert "--network" in run_argv[1] and "bridge" in run_argv[1]
         finally:
             sandbox.close()
 
@@ -1059,20 +1076,24 @@ class TestStartupSandbox:
 
         # Without refresh the stamp is a hit: no provision container runs.
         runner = FakeRunner(ok("1.54"), ok("linux"), ok(""), ok(""))
-        sandbox = startup_sandbox(cfg, workspace=ws, runner=runner)
+        sandbox = startup_sandbox(cfg, workspace=ws, state_dir=tmp_path / "run-state", runner=runner)
         sandbox.close()
         assert not [c for c in runner.calls if "python -m venv .venv-sandbox" in c]
 
         # With refresh the stamp is ignored: provision re-runs.
         runner2 = FakeRunner(ok("1.54"), ok("linux"), ok(""), ok(""), ok(""))
-        sandbox2 = startup_sandbox(cfg, workspace=ws, runner=runner2, refresh=True)
+        sandbox2 = startup_sandbox(cfg, workspace=ws,
+                                   state_dir=tmp_path / "run-state",
+                                   runner=runner2, refresh=True)
         sandbox2.close()
         assert [c for c in runner2.calls if "python -m venv .venv-sandbox" in c]
 
     def test_relocated_venv_dir_flows_into_payloads(self, tmp_path, monkeypatch):
         """022: a set `sandbox_venv_dir` is resolved and threaded into BOTH the
-        exec and provision payloads; the workspace stays free of `.venv-sandbox`
-        noise (the outside dir is mounted at the unchanged container path)."""
+        exec and provision payloads. The exec (base export) container maps it
+        into the export at `.venv-sandbox`; the provision container maps it
+        into the real workspace path. The workspace stays free of
+        `.venv-sandbox` noise either way."""
         from agentic_dev_loop.engine.isolation import startup_sandbox
 
         ws = tmp_path / "ws"
@@ -1090,14 +1111,18 @@ class TestStartupSandbox:
             ok(""),               # docker run -d --rm (exec container)
             ok(""),               # docker run provision
         )
-        sandbox = startup_sandbox(cfg, workspace=ws, runner=runner)
+        sandbox = startup_sandbox(cfg, workspace=ws, state_dir=tmp_path / "run-state", runner=runner)
         try:
-            target = f"{venv_dir}:{ws}/.venv-sandbox"
-            for argv in runner.calls:
-                if argv[:2] == ["docker", "run"]:
-                    assert target in argv
-                    assert argv[argv.index(target) - 1] == "-v"
-                    assert f"{ws}/.venv:ro" in argv
+            root = sandbox.export_root
+            exec_argv = [c for c in runner.calls
+                         if c[:2] == ["docker", "run"] and "--detach" in c][0]
+            prov_argv = [c for c in runner.calls
+                         if c[:2] == ["docker", "run"] and "--detach" not in c][0]
+            exec_target = f"{venv_dir}:{root}/.venv-sandbox"
+            prov_target = f"{venv_dir}:{ws}/.venv-sandbox"
+            assert exec_argv[exec_argv.index(exec_target) - 1] == "-v"
+            assert prov_argv[prov_argv.index(prov_target) - 1] == "-v"
+            assert f"{ws}/.venv:ro" in prov_argv
         finally:
             sandbox.close()
 
@@ -1121,7 +1146,7 @@ class TestStartupSandbox:
             ok(""),       # image inspect
             ok(""),       # docker run -d --rm (exec container)
         )
-        sandbox = startup_sandbox(cfg, workspace=ws, runner=runner)
+        sandbox = startup_sandbox(cfg, workspace=ws, state_dir=tmp_path / "run-state", runner=runner)
         try:
             run_argv = [c for c in runner.calls if c[:2] == ["docker", "run"]][0]
             resolved = chromium_userns_profile_path()
@@ -1146,7 +1171,7 @@ class TestStartupSandbox:
         monkeypatch.setenv("AGENTIC_DEV_LOOP_DEV_IMAGE", "img:tag")
         runner = FakeRunner()
         with pytest.raises(ValueError, match="bundled:chromium-userns"):
-            startup_sandbox(cfg, workspace=ws, runner=runner)
+            startup_sandbox(cfg, workspace=ws, state_dir=tmp_path / "run-state", runner=runner)
         assert runner.calls == []
 
     def test_in_workspace_sandbox_venv_dir_fails_loud(self, tmp_path, monkeypatch):
@@ -1161,7 +1186,7 @@ class TestStartupSandbox:
         monkeypatch.setenv("AGENTIC_DEV_LOOP_DEV_IMAGE", "img:tag")
         runner = FakeRunner(ok("1.54"), ok("linux"))
         with pytest.raises(SandboxError, match="AE-SBX-015"):
-            startup_sandbox(cfg, workspace=ws, runner=runner)
+            startup_sandbox(cfg, workspace=ws, state_dir=tmp_path / "run-state", runner=runner)
 
 
 class TestBundledSeccompProfile:

{agentic_dev_loop-1.0.0a18 → agentic_dev_loop-1.0.0a20}/tests/test_step_workspace.py

@@ -32,6 +32,26 @@ def test_materialise_copies_except_git_and_host_only(tmp_path):
     assert not (export / ".venv").exists()
 
 
+def test_materialise_preserves_symlinks_without_resolving(tmp_path):
+    repo = _repo(tmp_path)
+    (repo / "links").mkdir()
+    (repo / "links" / "dangling").symlink_to("nowhere")
+    (repo / "links" / "valid").symlink_to("../src/a.py")
+    export = tmp_path / "state" / "exports" / "run1"
+    # Completing materialise also proves the baseline snapshot survives the
+    # dangling link (it runs _snapshot on the export after the copy).
+    StepWorkspace.materialise(repo, [], "linux", export)
+    dangling = export / "links" / "dangling"
+    valid = export / "links" / "valid"
+    # Symlinks copy as symlinks, never resolved against the host: the
+    # dangling one stays dangling, the valid one keeps its relative target.
+    assert dangling.is_symlink()
+    assert os.readlink(dangling) == "nowhere"
+    assert not dangling.exists()
+    assert valid.is_symlink()
+    assert os.readlink(valid) == "../src/a.py"
+
+
 def test_missing_cache_is_loud(tmp_path):
     repo = _repo(tmp_path)
     export = tmp_path / "state" / "exports" / "run1"

{agentic_dev_loop-1.0.0a18 → agentic_dev_loop-1.0.0a20}/tests/test_sync_back.py

@@ -2,6 +2,7 @@
 only, .git never touched, conflicts loud."""
 
 import hashlib
+import os
 
 import pytest
 
@@ -100,6 +101,24 @@ def test_whole_tree_dot_syncs_back(tmp_path):
     assert (ws / "docs" / "new.md").read_text() == "new"
 
 
+def test_symlink_syncs_as_symlink_never_resolved(tmp_path):
+    """A symlink the sandbox creates in a declared-rw path syncs back as a
+    symlink, including a dangling one (whose target only makes sense inside
+    the export). Resolving it against the host would crash or corrupt."""
+    ws = _workspace(tmp_path)
+    exp = _export(tmp_path, ws)
+    (exp / "links").mkdir()
+    (exp / "links" / "to-src").symlink_to("../src/a.py")
+    (exp / "links" / "dangling").symlink_to("no-such-target")
+    report = sync_back(exp, ws, declared_rw=["."])
+    assert report.conflicts == ()
+    assert set(report.synced_paths) == {"links/to-src", "links/dangling"}
+    assert (ws / "links" / "to-src").is_symlink()
+    assert os.readlink(ws / "links" / "to-src") == "../src/a.py"
+    assert (ws / "links" / "dangling").is_symlink()
+    assert os.readlink(ws / "links" / "dangling") == "no-such-target"
+
+
 def test_cache_not_deleted(tmp_path):
     """BR-3/F2: a bind-mounted cache is absent from the export but present in
     the real repo - a ``.``-rw sync-back must never classify it as a deletion