agentic-dev-loop 1.0.0a27__tar.gz → 1.0.0a28__tar.gz

{agentic_dev_loop-1.0.0a27/src/agentic_dev_loop.egg-info → agentic_dev_loop-1.0.0a28}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentic-dev-loop
-Version: 1.0.0a27
+Version: 1.0.0a28
 Summary: Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase.
 Author: Luke Wilson
 License-Expression: Apache-2.0
@@ -228,7 +228,7 @@ steps:
 | `agent:` / `command:` / `action:` | Exactly one per step. Agents live in `agents_dir` as `<name>.agent.md`; commands run sandboxed (mechanical, never an LLM call). `commit` is the sole host-side built-in action; consumer actions are sandbox-executed, command-shaped scripts (see [Host boundary](#host-boundary-security-model)). |
 | `produces:` / `artifact:` + `verdicts:` | Hygiene-tracked outputs vs verdict-parsed routing. The **last** `VERDICT:` line wins; stale artifacts are deleted at each attempt start. |
 | `on_pass:` / `on_fail:` | A step name, terminal `success`/`failure`, or `{goto: X, retry: true}`. No loops happen unless you write them. |
-| `env:` / `setup:` / `network:` | `env:` declares step vars (fixed safe base + declared vars only); `setup:` provisions the sandbox (command steps, network ON, stamp-cached); `network: true` lets a command/agent step reach the hosts its `egress:` allowlist names (default off) - see [Per-stage networking](#per-stage-networking). |
+| `env:` / `setup:` / `network:` | `env:` declares step vars (fixed safe base + declared vars only); `setup:` provisions the sandbox before the step runs (command or agent steps; network ON; stamp-cached, re-runs when the pipeline's lockfiles change); `network: true` lets a command/agent step reach the hosts its `egress:` allowlist names (default off) - see [Per-stage networking](#per-stage-networking). |
 | `mounts:` / `egress:` | Per-step workspace isolation. `mounts:` lists `{path, mode}` entries (`rw`/`ro`, default `ro`) and is **strict-by-default** - empty/missing mounts nothing; only declared-rw paths sync back to the repo. `egress:` is `{class, presets, targets}` (`class: browser` = broad-but-logged; otherwise a strict allowlist). See [Per-stage networking](#per-stage-networking) and [docs/setup.md](docs/setup.md). |
 | `secrets:` (top-level) / step `secrets:` | Declares secret **refs only - never values**; each step opts in to the refs it needs. Resolved host-side and injected into that step's exec env only. See [Secrets](#secrets--refs-only-never-values). |
 | `isolation:` (optional) | Configures the sandbox - image override, resource caps, `allow_git_mutations`, `seccomp_profile`. It can never disable it. See [browser sandbox](docs/browser-sandbox.md). |
@@ -236,7 +236,7 @@ steps:
 | `extensions_dir` | Where consumer `extensions:` modules resolve - defaults to `~/.agentic-dev-loop/extensions`, **outside** the workspace. Workspace-resident extension/tool modules are refused at load. |
 | `deps_policy` | `locked` (default) or `open`. `locked` = the human-owned lockfile is the source of truth and the agent may not add dependencies; `open` = the bootstrap protocol (the agent may add exact-pinned manifest entries). See [Dependency policy](#dependency-policy-locked-by-default). |
 | `lockfiles` | The pipeline's declared lockfile names (workspace-relative), injected into agent context and named by the missing-dependency fail-fast. Required (non-empty) when `deps_policy: locked` - a `locked` pipeline with no lockfiles fails fast at load. |
-| `caches:` / `sync_excludes:` | Top-level run-wide lists. `caches:` names repo-relative toolchain cache dirs bind-mounted rw from the real workspace (auto-created if missing); `sync_excludes:` names scratch paths skipped from both the export copy and sync-back (wildcard `*` spans separators, so `**/bin/**` matches a `/bin/` segment at any depth). Both default to `[]`. See [docs/setup.md](docs/setup.md). |
+| `caches:` / `sync_excludes:` | Top-level run-wide lists. `caches:` names repo-relative toolchain cache dirs bind-mounted rw from the real workspace (auto-created if missing); a `setup:` hook can warm them (the provision container carries the same cache mounts); `sync_excludes:` names scratch paths skipped from both the export copy and sync-back (wildcard `*` spans separators, so `**/bin/**` matches a `/bin/` segment at any depth). Both default to `[]`. See [docs/setup.md](docs/setup.md). |
 | `merge_on_conflict:` | Top-level run-wide list of append-style logs (same path vocabulary as `sync_excludes:`, default `[]`). A concurrent host edit to a listed path is union-merged instead of raising: the host file wins and the sandbox's export-only lines are appended in order; both sides converge and the run continues. See [docs/setup.md](docs/setup.md). |
 
 ### Secrets (`secrets:`) - refs only, never values
@@ -432,7 +432,8 @@ Adaptation checklist for a new repo:
    only if a stage runs Chromium.
 3. `caches:` - toolchain cache dirs as rw bind-mounts shared across runs
    (`.nuget-packages`, `qa/node_modules`, `qa/.browsers`,
-   `frontend-editor/node_modules`); caches are never synced back.
+   `frontend-editor/node_modules`); caches are never synced back, and a
+   step's `setup:` hook runs with them mounted so it can warm them.
 4. `sync_excludes:` - build output trees (`**/bin/**`, `**/obj/**`).
 5. `secrets:` - refs only, resolved from host env; each step opts in to the
    refs it needs.

{agentic_dev_loop-1.0.0a27 → agentic_dev_loop-1.0.0a28}/README.md

@@ -186,7 +186,7 @@ steps:
 | `agent:` / `command:` / `action:` | Exactly one per step. Agents live in `agents_dir` as `<name>.agent.md`; commands run sandboxed (mechanical, never an LLM call). `commit` is the sole host-side built-in action; consumer actions are sandbox-executed, command-shaped scripts (see [Host boundary](#host-boundary-security-model)). |
 | `produces:` / `artifact:` + `verdicts:` | Hygiene-tracked outputs vs verdict-parsed routing. The **last** `VERDICT:` line wins; stale artifacts are deleted at each attempt start. |
 | `on_pass:` / `on_fail:` | A step name, terminal `success`/`failure`, or `{goto: X, retry: true}`. No loops happen unless you write them. |
-| `env:` / `setup:` / `network:` | `env:` declares step vars (fixed safe base + declared vars only); `setup:` provisions the sandbox (command steps, network ON, stamp-cached); `network: true` lets a command/agent step reach the hosts its `egress:` allowlist names (default off) - see [Per-stage networking](#per-stage-networking). |
+| `env:` / `setup:` / `network:` | `env:` declares step vars (fixed safe base + declared vars only); `setup:` provisions the sandbox before the step runs (command or agent steps; network ON; stamp-cached, re-runs when the pipeline's lockfiles change); `network: true` lets a command/agent step reach the hosts its `egress:` allowlist names (default off) - see [Per-stage networking](#per-stage-networking). |
 | `mounts:` / `egress:` | Per-step workspace isolation. `mounts:` lists `{path, mode}` entries (`rw`/`ro`, default `ro`) and is **strict-by-default** - empty/missing mounts nothing; only declared-rw paths sync back to the repo. `egress:` is `{class, presets, targets}` (`class: browser` = broad-but-logged; otherwise a strict allowlist). See [Per-stage networking](#per-stage-networking) and [docs/setup.md](docs/setup.md). |
 | `secrets:` (top-level) / step `secrets:` | Declares secret **refs only - never values**; each step opts in to the refs it needs. Resolved host-side and injected into that step's exec env only. See [Secrets](#secrets--refs-only-never-values). |
 | `isolation:` (optional) | Configures the sandbox - image override, resource caps, `allow_git_mutations`, `seccomp_profile`. It can never disable it. See [browser sandbox](docs/browser-sandbox.md). |
@@ -194,7 +194,7 @@ steps:
 | `extensions_dir` | Where consumer `extensions:` modules resolve - defaults to `~/.agentic-dev-loop/extensions`, **outside** the workspace. Workspace-resident extension/tool modules are refused at load. |
 | `deps_policy` | `locked` (default) or `open`. `locked` = the human-owned lockfile is the source of truth and the agent may not add dependencies; `open` = the bootstrap protocol (the agent may add exact-pinned manifest entries). See [Dependency policy](#dependency-policy-locked-by-default). |
 | `lockfiles` | The pipeline's declared lockfile names (workspace-relative), injected into agent context and named by the missing-dependency fail-fast. Required (non-empty) when `deps_policy: locked` - a `locked` pipeline with no lockfiles fails fast at load. |
-| `caches:` / `sync_excludes:` | Top-level run-wide lists. `caches:` names repo-relative toolchain cache dirs bind-mounted rw from the real workspace (auto-created if missing); `sync_excludes:` names scratch paths skipped from both the export copy and sync-back (wildcard `*` spans separators, so `**/bin/**` matches a `/bin/` segment at any depth). Both default to `[]`. See [docs/setup.md](docs/setup.md). |
+| `caches:` / `sync_excludes:` | Top-level run-wide lists. `caches:` names repo-relative toolchain cache dirs bind-mounted rw from the real workspace (auto-created if missing); a `setup:` hook can warm them (the provision container carries the same cache mounts); `sync_excludes:` names scratch paths skipped from both the export copy and sync-back (wildcard `*` spans separators, so `**/bin/**` matches a `/bin/` segment at any depth). Both default to `[]`. See [docs/setup.md](docs/setup.md). |
 | `merge_on_conflict:` | Top-level run-wide list of append-style logs (same path vocabulary as `sync_excludes:`, default `[]`). A concurrent host edit to a listed path is union-merged instead of raising: the host file wins and the sandbox's export-only lines are appended in order; both sides converge and the run continues. See [docs/setup.md](docs/setup.md). |
 
 ### Secrets (`secrets:`) - refs only, never values
@@ -390,7 +390,8 @@ Adaptation checklist for a new repo:
    only if a stage runs Chromium.
 3. `caches:` - toolchain cache dirs as rw bind-mounts shared across runs
    (`.nuget-packages`, `qa/node_modules`, `qa/.browsers`,
-   `frontend-editor/node_modules`); caches are never synced back.
+   `frontend-editor/node_modules`); caches are never synced back, and a
+   step's `setup:` hook runs with them mounted so it can warm them.
 4. `sync_excludes:` - build output trees (`**/bin/**`, `**/obj/**`).
 5. `secrets:` - refs only, resolved from host env; each step opts in to the
    refs it needs.

{agentic_dev_loop-1.0.0a27 → agentic_dev_loop-1.0.0a28}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agentic-dev-loop"
-version = "1.0.0a27"
+version = "1.0.0a28"
 description = "Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase."
 readme = "README.md"
 requires-python = ">=3.12"

{agentic_dev_loop-1.0.0a27 → agentic_dev_loop-1.0.0a28}/src/agentic_dev_loop/core/config.py

@@ -386,9 +386,9 @@ class StepConfig(BaseModel):
             raise ValueError(
                 f"step {self.name!r}: 'timeout' requires 'command'"
             )
-        if self.setup is not None and self.command is None:
+        if self.setup is not None and self.command is None and self.agent is None:
             raise ValueError(
-                f"step {self.name!r}: 'setup' is only allowed on 'command' steps"
+                f"step {self.name!r}: 'setup' is only allowed on 'command' or 'agent' steps"
             )
         # `network` is NOT rejected here: the schema can't tell a host-side
         # built-in action (e.g. `commit`, which must never take egress) from

{agentic_dev_loop-1.0.0a27 → agentic_dev_loop-1.0.0a28}/src/agentic_dev_loop/engine/isolation.py

@@ -699,11 +699,14 @@ def docker_create_payload(*, run_id: str, image: str, profile: EffectiveProfile,
 
 def docker_provision_payload(*, run_id: str, image: str, workspace: str,
                              setup_cmd: str,
-                             sandbox_venv_dir: str | None = None) -> list[str]:
+                             sandbox_venv_dir: str | None = None,
+                             cache_mounts: list[tuple[str, str, str]]
+                             | None = None) -> list[str]:
     """Exact ``docker run --rm`` argv for the provision container (§3.4).
     Network ON (default bridge), rw rootfs, --cap-drop ALL, mount set
-    {workspace} + host-only masks (022); --user host uid:gid (AE-SBX-009) with
-    HOME=/tmp."""
+    {workspace} + host-only masks (022) + the declared cache paths (028, rw
+    bind mounts so a ``setup:`` hook can warm them); --user host uid:gid
+    (AE-SBX-009) with HOME=/tmp."""
     payload = [
         "docker", "run", "--rm", "--name", f"{run_id}-provision",
         "--network", "bridge", "--cap-drop", "ALL",
@@ -713,6 +716,8 @@ def docker_provision_payload(*, run_id: str, image: str, workspace: str,
     if user is not None:
         payload.extend(["--user", user, "--env", "HOME=/tmp"])
     payload.extend(_sandbox_mounts(workspace, sandbox_venv_dir))
+    for source, target, _mode in (cache_mounts or []):
+        payload += ["-v", f"{source}:{target}"]
     payload.extend([
         "--workdir", workspace,
         image, "sh", "-c", setup_cmd,
@@ -995,7 +1000,8 @@ class DockerBackend(Sandbox):
                 return
         payload = docker_provision_payload(
             run_id=self._run_id, image=self._image, workspace=self._workspace,
-            setup_cmd=setup_cmd, sandbox_venv_dir=self._sandbox_venv_dir)
+            setup_cmd=setup_cmd, sandbox_venv_dir=self._sandbox_venv_dir,
+            cache_mounts=self._cache_mounts)
         res = self._runner.run(payload, timeout=PROVISION_TIMEOUT_SECONDS)
         if res.exit_code != 0:
             tail = (res.stdout or res.stderr or "")[-4000:]
@@ -1541,7 +1547,9 @@ def _file_digest(p: Path) -> str:
 def _declared_setups(cfg: PipelineConfig, workspace: Path):
     hashes = _lockfile_hashes(workspace)
     for step in cfg.steps:
-        if step.command is not None and step.setup is not None:
+        if step.setup is not None and (
+            step.command is not None or step.agent is not None
+        ):
             yield step.setup, setup_stamp_key(step.setup, hashes)
 
 

{agentic_dev_loop-1.0.0a27 → agentic_dev_loop-1.0.0a28}/src/agentic_dev_loop/engine/stages.py

@@ -409,7 +409,7 @@ def make_agent_node(runtime: Runtime, step: StepConfig):
                     update["artifacts"] = {step.name: result.response}
                 return update
             if verdict == "unverifiable":
-                print(f"[{subject}] {step.name} qa verdict: UNVERIFIABLE "
+                print(f"[{subject}] {step.name} verdict: UNVERIFIABLE "
                       f"(moves on).", flush=True)
                 update = {"step_verdicts": merged, "failed": False}
                 if captures and result.response is not None:

{agentic_dev_loop-1.0.0a27 → agentic_dev_loop-1.0.0a28/src/agentic_dev_loop.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentic-dev-loop
-Version: 1.0.0a27
+Version: 1.0.0a28
 Summary: Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase.
 Author: Luke Wilson
 License-Expression: Apache-2.0
@@ -228,7 +228,7 @@ steps:
 | `agent:` / `command:` / `action:` | Exactly one per step. Agents live in `agents_dir` as `<name>.agent.md`; commands run sandboxed (mechanical, never an LLM call). `commit` is the sole host-side built-in action; consumer actions are sandbox-executed, command-shaped scripts (see [Host boundary](#host-boundary-security-model)). |
 | `produces:` / `artifact:` + `verdicts:` | Hygiene-tracked outputs vs verdict-parsed routing. The **last** `VERDICT:` line wins; stale artifacts are deleted at each attempt start. |
 | `on_pass:` / `on_fail:` | A step name, terminal `success`/`failure`, or `{goto: X, retry: true}`. No loops happen unless you write them. |
-| `env:` / `setup:` / `network:` | `env:` declares step vars (fixed safe base + declared vars only); `setup:` provisions the sandbox (command steps, network ON, stamp-cached); `network: true` lets a command/agent step reach the hosts its `egress:` allowlist names (default off) - see [Per-stage networking](#per-stage-networking). |
+| `env:` / `setup:` / `network:` | `env:` declares step vars (fixed safe base + declared vars only); `setup:` provisions the sandbox before the step runs (command or agent steps; network ON; stamp-cached, re-runs when the pipeline's lockfiles change); `network: true` lets a command/agent step reach the hosts its `egress:` allowlist names (default off) - see [Per-stage networking](#per-stage-networking). |
 | `mounts:` / `egress:` | Per-step workspace isolation. `mounts:` lists `{path, mode}` entries (`rw`/`ro`, default `ro`) and is **strict-by-default** - empty/missing mounts nothing; only declared-rw paths sync back to the repo. `egress:` is `{class, presets, targets}` (`class: browser` = broad-but-logged; otherwise a strict allowlist). See [Per-stage networking](#per-stage-networking) and [docs/setup.md](docs/setup.md). |
 | `secrets:` (top-level) / step `secrets:` | Declares secret **refs only - never values**; each step opts in to the refs it needs. Resolved host-side and injected into that step's exec env only. See [Secrets](#secrets--refs-only-never-values). |
 | `isolation:` (optional) | Configures the sandbox - image override, resource caps, `allow_git_mutations`, `seccomp_profile`. It can never disable it. See [browser sandbox](docs/browser-sandbox.md). |
@@ -236,7 +236,7 @@ steps:
 | `extensions_dir` | Where consumer `extensions:` modules resolve - defaults to `~/.agentic-dev-loop/extensions`, **outside** the workspace. Workspace-resident extension/tool modules are refused at load. |
 | `deps_policy` | `locked` (default) or `open`. `locked` = the human-owned lockfile is the source of truth and the agent may not add dependencies; `open` = the bootstrap protocol (the agent may add exact-pinned manifest entries). See [Dependency policy](#dependency-policy-locked-by-default). |
 | `lockfiles` | The pipeline's declared lockfile names (workspace-relative), injected into agent context and named by the missing-dependency fail-fast. Required (non-empty) when `deps_policy: locked` - a `locked` pipeline with no lockfiles fails fast at load. |
-| `caches:` / `sync_excludes:` | Top-level run-wide lists. `caches:` names repo-relative toolchain cache dirs bind-mounted rw from the real workspace (auto-created if missing); `sync_excludes:` names scratch paths skipped from both the export copy and sync-back (wildcard `*` spans separators, so `**/bin/**` matches a `/bin/` segment at any depth). Both default to `[]`. See [docs/setup.md](docs/setup.md). |
+| `caches:` / `sync_excludes:` | Top-level run-wide lists. `caches:` names repo-relative toolchain cache dirs bind-mounted rw from the real workspace (auto-created if missing); a `setup:` hook can warm them (the provision container carries the same cache mounts); `sync_excludes:` names scratch paths skipped from both the export copy and sync-back (wildcard `*` spans separators, so `**/bin/**` matches a `/bin/` segment at any depth). Both default to `[]`. See [docs/setup.md](docs/setup.md). |
 | `merge_on_conflict:` | Top-level run-wide list of append-style logs (same path vocabulary as `sync_excludes:`, default `[]`). A concurrent host edit to a listed path is union-merged instead of raising: the host file wins and the sandbox's export-only lines are appended in order; both sides converge and the run continues. See [docs/setup.md](docs/setup.md). |
 
 ### Secrets (`secrets:`) - refs only, never values
@@ -432,7 +432,8 @@ Adaptation checklist for a new repo:
    only if a stage runs Chromium.
 3. `caches:` - toolchain cache dirs as rw bind-mounts shared across runs
    (`.nuget-packages`, `qa/node_modules`, `qa/.browsers`,
-   `frontend-editor/node_modules`); caches are never synced back.
+   `frontend-editor/node_modules`); caches are never synced back, and a
+   step's `setup:` hook runs with them mounted so it can warm them.
 4. `sync_excludes:` - build output trees (`**/bin/**`, `**/obj/**`).
 5. `secrets:` - refs only, resolved from host env; each step opts in to the
    refs it needs.

{agentic_dev_loop-1.0.0a27 → agentic_dev_loop-1.0.0a28}/tests/test_config.py

@@ -489,15 +489,19 @@ class TestStepEnvAndSetup:
                           "on_pass": "success"}]
         assert _load(tmp_path, data).steps[0].setup is not None
 
-    @pytest.mark.parametrize("step", [
-        {"name": "x", "agent": "dev", "setup": "npm i"},
-        {"name": "x", "action": "commit", "setup": "npm i"},
-    ])
-    def test_setup_rejected_on_non_command_steps(self, tmp_path, step):
+    def test_setup_allowed_on_agent_step(self, tmp_path):
         data = _base()
-        data["steps"] = [step | {"on_pass": "success"}]
-        with pytest.raises(ValidationError,
-                           match="'setup' is only allowed on 'command' steps"):
+        data["steps"] = [{"name": "dev", "agent": "dev", "setup": "npm i",
+                          "on_pass": "success"}]
+        assert _load(tmp_path, data).steps[0].setup == "npm i"
+
+    def test_setup_rejected_on_action_step(self, tmp_path):
+        data = _base()
+        data["steps"] = [{"name": "x", "action": "commit", "setup": "npm i",
+                          "on_pass": "success"}]
+        with pytest.raises(
+                ValidationError,
+                match="'setup' is only allowed on 'command' or 'agent' steps"):
             _load(tmp_path, data)
 
     def test_env_round_trip(self, tmp_path):

{agentic_dev_loop-1.0.0a27 → agentic_dev_loop-1.0.0a28}/tests/test_isolation.py

@@ -2109,3 +2109,43 @@ class TestReaper:
         self._write(tmp_path / "state", [own, other])
         backend.close()
         assert self._read(tmp_path / "state") == [other]
+
+
+def test_declared_setups_includes_agent_steps(tmp_path):
+    import yaml
+
+    from agentic_dev_loop.core.config import load_config
+    from agentic_dev_loop.engine.isolation import _declared_setups
+
+    (tmp_path / "uv.lock").write_text("")
+    data = {
+        "name": "t",
+        "llm": {"model": "m", "api_key_env": "K"},
+        "agents_dir": "agents",
+        "lockfiles": ["uv.lock"],
+        "steps": [
+            {"name": "dev", "agent": "dev",
+             "setup": "cd frontend-editor && npm ci", "on_pass": "success"},
+            {"name": "t", "command": "make", "setup": "echo warm",
+             "on_pass": "success"},
+        ],
+    }
+    p = tmp_path / "pipeline.yaml"
+    p.write_text(yaml.safe_dump(data))
+    cfg = load_config(p)
+    assert set(dict(_declared_setups(cfg, tmp_path))) == {
+        "cd frontend-editor && npm ci", "echo warm"}
+
+
+def test_provision_payload_mounts_declared_caches():
+    payload = docker_provision_payload(
+        run_id="run1",
+        image="img",
+        workspace="/ws",
+        setup_cmd="cd frontend-editor && npm ci",
+        cache_mounts=[
+            ("/host/fe/node_modules", "/ws/frontend-editor/node_modules", "rw"),
+        ],
+    )
+    assert "-v" in payload
+    assert "/host/fe/node_modules:/ws/frontend-editor/node_modules" in payload