agentic-dev-loop 1.0.0a32__tar.gz → 1.0.0a35__tar.gz

{agentic_dev_loop-1.0.0a32/src/agentic_dev_loop.egg-info → agentic_dev_loop-1.0.0a35}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentic-dev-loop
-Version: 1.0.0a32
+Version: 1.0.0a35
 Summary: Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase.
 Author: Luke Wilson
 License-Expression: Apache-2.0
@@ -242,6 +242,7 @@ steps:
 | `stop_when:` | Optional agent-step termination: `{ green_command: <argv regex>, post_green_turns: <int, default 2> }`. When the agent's most recent terminal observation matching `green_command` exits 0 and no workspace writes have happened since, the engine injects one nudge turn, allows `post_green_turns` further turns, then closes the conversation. Absent = run to finish. |
 | `terminal_timeout:` | Optional agent-step per-action timeout in seconds (gt 0). `SandboxTerminalExecutor` uses it when the agent leaves the terminal action timeout unset, overriding the SDK tool's default. `None` = current behavior. |
 | `finalize_nudge_turns:` | Optional agent-step final-response nudge (gt 0). Requires `max_iterations:` and must be less than it. At `max_iterations - finalize_nudge_turns` completed turns the engine injects one advisory turn ("`N turns remain: produce your final response now`"), exactly once; the agent may still exhaust its turns and existing stuck/unclear handling applies unchanged. Absent = current behavior. Provisional pending one consumer run (revert if noisy or the raised cap inflates cost). |
+| `custom_prompt:` | Planned (planning-docs/039). Optional agent-step value: literal text, or a path whose file contents are read at load time, appended verbatim to the agent prompt at context assembly (after the prompt, before the task/artifacts). A value that looks like a path but names no file is a validation error. Agent steps only. |
 | `on_pass:` / `on_fail:` | A step name, terminal `success`/`failure`, or `{goto: X, retry: true}`. No loops happen unless you write them. |
 | `env:` / `setup:` / `network:` | `env:` declares step vars (fixed safe base + declared vars only); `setup:` provisions the sandbox before the step runs (command or agent steps; network ON; stamp-cached, re-runs when the pipeline's lockfiles change); `network: true` lets a command/agent step reach the hosts its `egress:` allowlist names (default off) - see [Per-stage networking](#per-stage-networking). |
 | `mounts:` / `egress:` | Per-step workspace isolation. `mounts:` lists `{path, mode}` entries (`rw`/`ro`, default `ro`) and is **strict-by-default** - empty/missing mounts nothing; only declared-rw paths sync back to the repo. `egress:` is `{class, presets, targets}` (`class: browser` = broad-but-logged; otherwise a strict allowlist). See [Per-stage networking](#per-stage-networking) and [docs/setup.md](docs/setup.md). |
@@ -341,6 +342,16 @@ steps:
   to exactly the declared hosts for that stage; the default stays network-off
   everywhere. Reserve it for stages that need it (QA, integration). The
   residual risks are documented in [docs/setup.md](docs/setup.md).
+- **Host-service reachability (planned - planning-docs/037, 038).** A host
+  service reached at `host.docker.internal` through the proxy fails today:
+  the policy admits it, but the proxy dials from the host, where that
+  container-only name does not resolve (a 502 for the client). 037 rewrites
+  `host.docker.internal` to host loopback at the proxy dial site, so signed
+  host-service traffic (an S3 SDK against a local MinIO, say) reaches the
+  host through the enforced, logged path. 038 then replaces the
+  host-gateway model with a per-run internal network: sandboxes get no host
+  route, and a containerized proxy on a second host-access network is the
+  only egress path.
 
 ### Sync-back conflicts (host edits during a run)
 

{agentic_dev_loop-1.0.0a32 → agentic_dev_loop-1.0.0a35}/README.md

@@ -200,6 +200,7 @@ steps:
 | `stop_when:` | Optional agent-step termination: `{ green_command: <argv regex>, post_green_turns: <int, default 2> }`. When the agent's most recent terminal observation matching `green_command` exits 0 and no workspace writes have happened since, the engine injects one nudge turn, allows `post_green_turns` further turns, then closes the conversation. Absent = run to finish. |
 | `terminal_timeout:` | Optional agent-step per-action timeout in seconds (gt 0). `SandboxTerminalExecutor` uses it when the agent leaves the terminal action timeout unset, overriding the SDK tool's default. `None` = current behavior. |
 | `finalize_nudge_turns:` | Optional agent-step final-response nudge (gt 0). Requires `max_iterations:` and must be less than it. At `max_iterations - finalize_nudge_turns` completed turns the engine injects one advisory turn ("`N turns remain: produce your final response now`"), exactly once; the agent may still exhaust its turns and existing stuck/unclear handling applies unchanged. Absent = current behavior. Provisional pending one consumer run (revert if noisy or the raised cap inflates cost). |
+| `custom_prompt:` | Planned (planning-docs/039). Optional agent-step value: literal text, or a path whose file contents are read at load time, appended verbatim to the agent prompt at context assembly (after the prompt, before the task/artifacts). A value that looks like a path but names no file is a validation error. Agent steps only. |
 | `on_pass:` / `on_fail:` | A step name, terminal `success`/`failure`, or `{goto: X, retry: true}`. No loops happen unless you write them. |
 | `env:` / `setup:` / `network:` | `env:` declares step vars (fixed safe base + declared vars only); `setup:` provisions the sandbox before the step runs (command or agent steps; network ON; stamp-cached, re-runs when the pipeline's lockfiles change); `network: true` lets a command/agent step reach the hosts its `egress:` allowlist names (default off) - see [Per-stage networking](#per-stage-networking). |
 | `mounts:` / `egress:` | Per-step workspace isolation. `mounts:` lists `{path, mode}` entries (`rw`/`ro`, default `ro`) and is **strict-by-default** - empty/missing mounts nothing; only declared-rw paths sync back to the repo. `egress:` is `{class, presets, targets}` (`class: browser` = broad-but-logged; otherwise a strict allowlist). See [Per-stage networking](#per-stage-networking) and [docs/setup.md](docs/setup.md). |
@@ -299,6 +300,16 @@ steps:
   to exactly the declared hosts for that stage; the default stays network-off
   everywhere. Reserve it for stages that need it (QA, integration). The
   residual risks are documented in [docs/setup.md](docs/setup.md).
+- **Host-service reachability (planned - planning-docs/037, 038).** A host
+  service reached at `host.docker.internal` through the proxy fails today:
+  the policy admits it, but the proxy dials from the host, where that
+  container-only name does not resolve (a 502 for the client). 037 rewrites
+  `host.docker.internal` to host loopback at the proxy dial site, so signed
+  host-service traffic (an S3 SDK against a local MinIO, say) reaches the
+  host through the enforced, logged path. 038 then replaces the
+  host-gateway model with a per-run internal network: sandboxes get no host
+  route, and a containerized proxy on a second host-access network is the
+  only egress path.
 
 ### Sync-back conflicts (host edits during a run)
 

{agentic_dev_loop-1.0.0a32 → agentic_dev_loop-1.0.0a35}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agentic-dev-loop"
-version = "1.0.0a32"
+version = "1.0.0a35"
 description = "Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase."
 readme = "README.md"
 requires-python = ">=3.12"

{agentic_dev_loop-1.0.0a32 → agentic_dev_loop-1.0.0a35}/src/agentic_dev_loop/core/config.py

@@ -391,6 +391,7 @@ class StepConfig(BaseModel):
     brief_inputs: BriefInputsSpec | None = None  # agent steps only (033)
     env: dict[str, str | None] | None = None  # NFR-1: null = inherit host value
     setup: str | None = None  # BR-13: command steps only
+    forbidden_commands: list[str] = []  # banned-command regex deny-list (036 D1)
     network: bool = False  # per-stage egress (command/agent + sandbox actions; host-side actions reject at registry time)
     # unit-5: per-step mount granularity + egress policy. Empty mounts =
     # strict-by-default (BR-1.1); egress None = strict empty allowlist
@@ -420,6 +421,26 @@ class StepConfig(BaseModel):
     def _coerce_produces(cls, v: Any) -> Any:
         return [v] if isinstance(v, str) else v
 
+    @field_validator("forbidden_commands", mode="before")
+    @classmethod
+    def _coerce_forbidden_commands(cls, v: Any) -> Any:
+        return [v] if isinstance(v, str) else v
+
+    @field_validator("forbidden_commands")
+    @classmethod
+    def _valid_forbidden_commands(cls, v: list[str]) -> list[str]:
+        for pattern in v:
+            if not isinstance(pattern, str) or not pattern.strip():
+                raise ValueError(
+                    "forbidden_commands entries must be non-empty strings")
+            try:
+                re.compile(pattern)
+            except re.error as e:
+                raise ValueError(
+                    f"forbidden_commands entry {pattern!r} is not a valid "
+                    f"regex: {e}") from e
+        return v
+
     @model_validator(mode="after")
     def _check_shape(self) -> "StepConfig":
         for key in ("agent", "action", "command"):

{agentic_dev_loop-1.0.0a32 → agentic_dev_loop-1.0.0a35}/src/agentic_dev_loop/core/paths.py

@@ -67,3 +67,25 @@ def dir_excluded(dir_rel: str, excludes: tuple[str, ...] | list[str]) -> bool:
             if parts[:len(spec_parts)] == spec_parts:
                 return True
     return False
+
+
+def path_allowed(rel: str, allowlist: tuple[str, ...] | list[str]) -> bool:
+    """True when a repo-relative posix path matches an allowed path/glob.
+
+    Mirrors ``path_excluded`` semantics: literal entries match by component
+    prefix (the dir and everything under it); wildcard entries match by
+    ``fnmatch.fnmatchcase`` on the full posix relpath. A ``.`` (or blank)
+    entry allows the whole tree.
+    """
+    parts = relative_parts(rel)
+    for spec in allowlist:
+        if _has_wildcards(spec):
+            if fnmatch.fnmatchcase(rel, spec):
+                return True
+        else:
+            spec_parts = relative_parts(spec)
+            if not spec_parts:
+                return True
+            if parts[:len(spec_parts)] == spec_parts:
+                return True
+    return False

{agentic_dev_loop-1.0.0a32 → agentic_dev_loop-1.0.0a35}/src/agentic_dev_loop/engine/agents.py

@@ -15,6 +15,7 @@ from openhands.tools.file_editor import FileEditorTool  # noqa: F401 - registers
 from openhands.tools.task_tracker import TaskTrackerTool  # noqa: F401 - registers "task_tracker"
 from openhands.tools.terminal import TerminalTool  # noqa: F401 - registers "terminal"
 
+from .forbidden import ForbiddenRule, match_forbidden_command
 from .isolation import (SandboxError, SandboxExecutionRequest, command_argv,
                         resolve_sandbox_env)
 
@@ -68,7 +69,9 @@ class SandboxTerminalExecutor(ToolExecutor):
                  pipeline: str | None = None, step: str | None = None,
                  network: bool = False, mount_set=None, egress_policy=None,
                  terminal_timeout: float | None = None,
-                 on_terminal_result=None):
+                 on_terminal_result=None,
+                 forbidden_commands: tuple[ForbiddenRule, ...] | None = None,
+                 allowlist: tuple[str, ...] | None = None):
         self._sandbox = sandbox
         self._workspace = workspace
         self._env = env or {}
@@ -79,6 +82,8 @@ class SandboxTerminalExecutor(ToolExecutor):
         self._egress_policy = egress_policy
         self._terminal_timeout = terminal_timeout
         self._on_terminal_result = on_terminal_result
+        self._forbidden_commands = forbidden_commands
+        self._allowlist = allowlist
 
     def __call__(self, action, conversation=None):
         from openhands.tools.terminal import TerminalObservation
@@ -99,11 +104,19 @@ class SandboxTerminalExecutor(ToolExecutor):
         timeout = action.timeout
         if timeout is None and self._terminal_timeout is not None:
             timeout = self._terminal_timeout
+        argv = command_argv(action.command)
+        forbidden = match_forbidden_command(argv, self._forbidden_commands)
+        if forbidden is not None:
+            return TerminalObservation.from_text(
+                f"[forbidden: {forbidden}]", is_error=True,
+                command=action.command, exit_code=None, timeout=False,
+                metadata=CmdOutputMetadata(exit_code=-1))
         request = SandboxExecutionRequest(
-            argv=command_argv(action.command), cwd=self._workspace,
+            argv=argv, cwd=self._workspace,
             env=self._env, timeout=timeout,
             pipeline=self._pipeline, step=self._step, network=self._network,
-            mount_set=self._mount_set, egress_policy=self._egress_policy)
+            mount_set=self._mount_set, egress_policy=self._egress_policy,
+            allowlist=self._allowlist)
         try:
             result = self._sandbox.run(request)
         except SandboxError as exc:
@@ -142,7 +155,9 @@ def register_sandbox_terminal(sandbox: "Sandbox", *, env: dict[str, str | None]
                               mount_set=None, egress_policy=None,
                               terminal_timeout: float | None = None,
                               on_terminal_result=None,
-                              secrets: dict[str, str] | None = None) -> None:
+                              secrets: dict[str, str] | None = None,
+                              forbidden_commands: tuple[ForbiddenRule, ...] | None = None,
+                              allowlist: tuple[str, ...] | None = None) -> None:
     """Per-run re-registration of the `terminal` name (KD-4): a callable
     factory that builds the SDK terminal with a `SandboxTerminalExecutor`.
     Pipelines are sequential, so re-registering per agent step is safe.
@@ -161,6 +176,8 @@ def register_sandbox_terminal(sandbox: "Sandbox", *, env: dict[str, str | None]
                 pipeline=pipeline, step=step, network=network,
                 mount_set=mount_set, egress_policy=egress_policy,
                 terminal_timeout=terminal_timeout,
-                on_terminal_result=on_terminal_result))
+                on_terminal_result=on_terminal_result,
+                forbidden_commands=forbidden_commands,
+                allowlist=allowlist))
 
     register_tool("terminal", factory)

agentic_dev_loop-1.0.0a35/src/agentic_dev_loop/engine/allowlist.py

@@ -0,0 +1,66 @@
+"""Engine-lane allowlist (036 D2 v1).
+
+The active AI-DLC unit directory may carry ``engine-allowlist.yaml`` - a YAML
+list of repo-relative allowed paths/globs. Absent = unrestricted (backward
+compatible). Present = sync-back asserts every merged/synced path matches an
+entry and fails the step otherwise. v2 (read-only export root with rw
+bind-mounts for the allowlisted paths) is deferred.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import yaml
+
+from agentic_dev_loop.core.config import _validate_declared_path
+from .loaders import select_loader
+
+ALLOWLIST_FILENAME = "engine-allowlist.yaml"
+
+
+def load_engine_allowlist(path: str | Path) -> list[str]:
+    """Parse and validate an ``engine-allowlist.yaml`` file.
+
+    The file is a plain YAML list of repo-relative path/glob strings (the
+    same declared-path vocabulary as ``sync_excludes:``). An empty file is a
+    valid, deliberately empty allowlist (nothing matches, so every synced
+    path violates the lane). Missing files are handled by the caller as the
+    unrestricted case, not here.
+    """
+    path = Path(path)
+    if not path.is_file():
+        raise FileNotFoundError(f"engine allowlist file not found: {path}")
+    data = yaml.safe_load(path.read_text(encoding="utf-8"))
+    if data is None:
+        return []
+    if not isinstance(data, list):
+        raise ValueError(
+            f"{ALLOWLIST_FILENAME} must be a YAML list of paths/globs, "
+            f"got {type(data).__name__}")
+    return [_validate_declared_path(entry, allow_wildcards=True)
+            for entry in data]
+
+
+def resolve_engine_allowlist(registry, args) -> list[str] | None:
+    """Resolve the active unit's allowlist, or None when unrestricted.
+
+    Only AI-DLC unit loaders expose a unit directory; other loaders (plan,
+    none) have no lane boundary. The file lives at
+    ``<unit_dir>/engine-allowlist.yaml``.
+    """
+    loader = select_loader(registry, args)
+    if loader is None:
+        return None
+    unit_dir = getattr(loader, "unit_dir", None)
+    if not callable(unit_dir):
+        return None
+    try:
+        path = Path(unit_dir(args)) / ALLOWLIST_FILENAME
+    except (FileNotFoundError, RuntimeError):
+        # No active AI-DLC unit can be determined (e.g. a resumed run with no
+        # aidlc-state file) -> no lane boundary, exactly like an absent file.
+        return None
+    if not path.is_file():
+        return None
+    return load_engine_allowlist(path)

{agentic_dev_loop-1.0.0a32 → agentic_dev_loop-1.0.0a35}/src/agentic_dev_loop/engine/extensions/aidlc.py

@@ -138,6 +138,12 @@ class AidlcDocumentLoader:
         _, sources = resolve_unit_docs_with_sources(self.docs_dir, unit)
         return sources
 
+    def unit_dir(self, args: argparse.Namespace) -> Path:
+        """The active unit directory (036): where the engine lane boundary
+        looks for ``engine-allowlist.yaml``."""
+        unit = getattr(args, "aidlc_unit", None) or get_current_unit(self.docs_dir)
+        return Path(self.docs_dir) / "construction" / unit
+
 
 class AidlcExtension:
     name = "ai-dlc"

agentic_dev_loop-1.0.0a35/src/agentic_dev_loop/engine/forbidden.py

@@ -0,0 +1,91 @@
+"""Banned-command deny-list (036 D1).
+
+The sandbox terminal enforces a deny-list before any shell spawn: a command
+whose argv matches a step's ``forbidden_commands:`` regex (merged with the
+engine defaults) returns a structured observation instead of reaching the
+sandbox. Command steps are unaffected - they are declared infrastructure and
+already fail fast on their exit code.
+
+The default list carries human-readable labels; custom entries use their
+regex text as the label. ``dotnet restore`` and ``dotnet add`` are network
+gated: denied only while the step's ``network:`` flag is off.
+"""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+
+
+@dataclass(frozen=True)
+class ForbiddenRule:
+    label: str
+    regex: re.Pattern[str]
+
+
+_DEFAULT_PATTERNS: tuple[tuple[str, str], ...] = (
+    ("git commit", r"\bgit\s+commit\b"),
+    ("git push", r"\bgit\s+push\b"),
+    ("git rebase", r"\bgit\s+rebase\b"),
+    ("git checkout", r"\bgit\s+checkout\b"),
+    ("git reset", r"\bgit\s+reset\b"),
+    ("git tag", r"\bgit\s+tag\b"),
+    ("npm install", r"\bnpm\s+install\b"),
+    ("npm ci", r"\bnpm\s+ci\b"),
+    ("pip install", r"\bpip\s+install\b"),
+    ("uv add", r"\buv\s+add\b"),
+    ("pip-compile", r"\bpip-compile\b"),
+    ("dotnet add package", r"\bdotnet\s+add\s+package\b"),
+    ("npx playwright", r"\bnpx\s+playwright\b"),
+    ("playwright", r"\bplaywright\b"),
+    ("docker", r"\bdocker\b"),
+)
+
+_NETWORK_GATED_PATTERNS: tuple[tuple[str, str], ...] = (
+    ("dotnet restore", r"\bdotnet\s+restore\b"),
+    ("dotnet add", r"\bdotnet\s+add\b"),
+)
+
+
+def _compile(label: str, pattern: str) -> ForbiddenRule:
+    return ForbiddenRule(label=label, regex=re.compile(pattern, re.IGNORECASE))
+
+
+DEFAULT_FORBIDDEN_RULES: tuple[ForbiddenRule, ...] = tuple(
+    _compile(label, pattern) for label, pattern in _DEFAULT_PATTERNS)
+
+NETWORK_GATED_FORBIDDEN_RULES: tuple[ForbiddenRule, ...] = tuple(
+    _compile(label, pattern) for label, pattern in _NETWORK_GATED_PATTERNS)
+
+
+def resolve_forbidden_rules(custom_patterns: list[str] | tuple[str, ...] | None,
+                            network: bool) -> tuple[ForbiddenRule, ...]:
+    """Merge the engine defaults with a step's custom regex list.
+
+    Custom entries are appended after the defaults, so the first match wins
+    on overlap. Network-gated defaults are included only while ``network`` is
+    off; there is no disable escape hatch for the engine defaults.
+    """
+    rules = list(DEFAULT_FORBIDDEN_RULES)
+    if not network:
+        rules.extend(NETWORK_GATED_FORBIDDEN_RULES)
+    for pattern in custom_patterns or ():
+        rules.append(_compile(pattern, pattern))
+    return tuple(rules)
+
+
+def match_forbidden_command(argv: list[str],
+                            rules: tuple[ForbiddenRule, ...] | None) -> str | None:
+    """Return the label of the first matching rule for ``argv``, else None.
+
+    Match is a regex search over the space-joined argv, so shell-wrapped
+    commands (``/bin/sh -c "git commit ..."``) still match. Empty argv never
+    matches.
+    """
+    if not argv:
+        return None
+    text = " ".join(argv)
+    for rule in rules or ():
+        if rule.regex.search(text):
+            return rule.label
+    return None

{agentic_dev_loop-1.0.0a32 → agentic_dev_loop-1.0.0a35}/src/agentic_dev_loop/engine/graph.py

@@ -18,6 +18,7 @@ from langgraph.graph import END, START, StateGraph
 
 from agentic_dev_loop import viz
 from .actions import git_worktree_clean, kill_listeners_on_port
+from .allowlist import resolve_engine_allowlist
 from agentic_dev_loop.core.config import load_config
 from .hostboundary import (check_orchestrator_install,
                            check_tooling_integrity, tooling_rel_paths)
@@ -170,11 +171,13 @@ def run_pipeline(cfg_path, args, *, viz_bus=None,
 def _run_pipeline(cfg, base, registry, state_dir, max_attempts, args, viz_bus,
                   sandbox, resolved_secrets, tooling_paths) -> tuple[bool, int]:
     export_root = getattr(sandbox, "export_root", None)
+    engine_allowlist = resolve_engine_allowlist(registry, args)
     runtime = Runtime(cfg=cfg, registry=registry, llm=build_llm(cfg.llm),
                       agents_dir=base / cfg.agents_dir, state_dir=state_dir,
                       workspace=Path.cwd(), sandbox=sandbox,
                       sandbox_cwd=Path(export_root) if export_root else None,
-                      secrets=resolved_secrets)
+                      secrets=resolved_secrets,
+                      engine_allowlist=engine_allowlist)
     state_dir.mkdir(parents=True, exist_ok=True)
 
     resume = getattr(args, "resume", None)

{agentic_dev_loop-1.0.0a32 → agentic_dev_loop-1.0.0a35}/src/agentic_dev_loop/engine/isolation.py

@@ -121,6 +121,10 @@ class SandboxExecutionRequest:
     # Host-side audit metadata (BR-11) - never sent into the container.
     pipeline: str | None = None
     step: str | None = None
+    # 036 lane boundary (v1): the unit allowlist every synced path must match.
+    # None = unrestricted (no engine-allowlist.yaml); an empty tuple = present
+    # but empty file (deny all synced paths).
+    allowlist: tuple[str, ...] | None = None
 
     def __post_init__(self) -> None:
         if not self.argv:
@@ -1071,7 +1075,7 @@ class DockerBackend(Sandbox):
         result = self._exec(request, prof.name)
         report: SyncBackReport | None = None
         if mount_set.rw_paths() and self._export_root is not None:
-            report = self._sync_back(mount_set)
+            report = self._sync_back(mount_set, request.allowlist)
         if report is not None and (report.synced_paths or report.merged_paths):
             result = SandboxExecutionResult(
                 exit_code=result.exit_code, stdout=result.stdout,
@@ -1169,7 +1173,8 @@ class DockerBackend(Sandbox):
         export_path.parent.mkdir(parents=True, exist_ok=True)
         shutil.copy2(host_path, export_path, follow_symlinks=False)
 
-    def _sync_back(self, mount_set: MountSet) -> SyncBackReport | None:
+    def _sync_back(self, mount_set: MountSet,
+                   allowlist: tuple[str, ...] | None = None) -> SyncBackReport | None:
         """Sync declared-rw export changes back to the real repo (BR-4/F1),
         git-aware, host-side, with the sandbox step already complete.
 
@@ -1184,7 +1189,18 @@ class DockerBackend(Sandbox):
             self._export_root, self._workspace, list(mount_set.rw_paths()),
             baseline=self._baseline, step_id=None,
             cache_paths=self._cache_paths, excludes=self._sync_excludes,
-            merge_on_conflict=self._merge_on_conflict)
+            merge_on_conflict=self._merge_on_conflict, allowlist=allowlist)
+
+        # 036 lane boundary (v1): fail the step before any copy/delete/merge
+        # so an out-of-lane write is never promoted into the real repo.
+        if report.lane_violations:
+            _announce(
+                "lane violation: "
+                + ", ".join(report.lane_violations)
+                + " outside engine-allowlist.yaml")
+            raise SandboxError(
+                "engine lane violation: synced/merged paths outside the unit "
+                "engine-allowlist.yaml: " + ", ".join(report.lane_violations))
 
         # 029 step 2: union-merge declared merge paths first, so a mixed
         # merge+hard conflict still converges the append-style logs before
@@ -1234,6 +1250,7 @@ class DockerBackend(Sandbox):
             "event": "sync_back",
             "synced_paths": list(report.synced_paths),
             "merged_paths": list(report.merged_paths),
+            "host_added_paths": list(report.host_added_paths),
         })
         return report
 

{agentic_dev_loop-1.0.0a32 → agentic_dev_loop-1.0.0a35}/src/agentic_dev_loop/engine/stages.py

@@ -38,7 +38,9 @@ from agentic_dev_loop.core.config import TERMINALS, PipelineConfig, Route, StepC
 from agentic_dev_loop.core.paths import _has_wildcards
 from .deps import extension_message, parse_missing_dependencies, policy_injection
 from .egress_policy import assemble_egress_policy
-from .isolation import SandboxExecutionRequest, command_argv, resolve_sandbox_env
+from .forbidden import resolve_forbidden_rules
+from .isolation import (SandboxError, SandboxExecutionRequest, command_argv,
+                        resolve_sandbox_env)
 from .mounts import resolve_mount_set
 from .outputs import CapturedOutput
 from .secrets import redact_values, step_secret_env
@@ -171,6 +173,9 @@ class Runtime:
     # the real workspace (no export materialised - fake/legacy paths).
     sandbox_cwd: Path | None = None
     secrets: dict[str, str] = field(default_factory=dict)
+    # 036 lane boundary (v1): the active unit's engine-allowlist.yaml paths;
+    # None = unrestricted (no allowlist file).
+    engine_allowlist: list[str] | None = None
 
     def run_agent(self, agent_name: str, message: str,
                   max_iterations: int = DEFAULT_MAX_ITERATIONS,
@@ -200,6 +205,13 @@ class Runtime:
                     cwd, mount_set, egress_policy = _step_sandbox(self, step)
                 else:
                     cwd, mount_set, egress_policy = (self.workspace, None, None)
+                forbidden_commands = (
+                    resolve_forbidden_rules(step.forbidden_commands,
+                                            step.network)
+                    if step is not None else None)
+                allowlist = (
+                    tuple(self.engine_allowlist)
+                    if self.engine_allowlist is not None else None)
                 register_sandbox_terminal(
                     self.sandbox,
                     env=step.env if step is not None else None,
@@ -214,7 +226,9 @@ class Runtime:
                     on_terminal_result=(controller.on_terminal_result
                                         if controller is not None else None),
                     secrets=(step_secret_env(self.cfg, step, self.secrets)
-                             if step is not None else None))
+                             if step is not None else None),
+                    forbidden_commands=forbidden_commands,
+                    allowlist=allowlist)
             agent = load_agent(self.agents_dir, agent_name, self.llm)
             callbacks = []
             if controller is not None:
@@ -364,7 +378,8 @@ def _run_command(command: str, workspace: Path, timeout: float,
                  network: bool = False,
                  mount_set=None,
                  egress_policy=None,
-                 cwd: Path | None = None) -> tuple[int | None, str, bool]:
+                 cwd: Path | None = None,
+                 allowlist: tuple[str, ...] | None = None) -> tuple[int | None, str, bool]:
     """Run a command step in the workspace, capturing combined stdout/stderr.
 
     With a ``Sandbox`` the command routes through the isolation boundary: git
@@ -381,7 +396,8 @@ def _run_command(command: str, workspace: Path, timeout: float,
         request = SandboxExecutionRequest(
             argv=command_argv(command), cwd=str(cwd or workspace), env=env or {},
             timeout=timeout, pipeline=pipeline, step=step, network=network,
-            mount_set=mount_set, egress_policy=egress_policy)
+            mount_set=mount_set, egress_policy=egress_policy,
+            allowlist=allowlist)
         result = sandbox.run(request)
         return result.exit_code, result.stdout + result.stderr, result.timed_out
     if needs_shell(command):
@@ -822,6 +838,8 @@ def make_command_node(runtime: Runtime, step: StepConfig):
     timeout = step.timeout if step.timeout is not None else DEFAULT_COMMAND_TIMEOUT
     sandbox = runtime.sandbox
     cwd, mount_set, egress_policy = _step_sandbox(runtime, step)
+    allowlist = (tuple(runtime.engine_allowlist)
+                 if runtime.engine_allowlist is not None else None)
     if sandbox is not None:
         env = resolve_sandbox_env(
             step.env, secrets=step_secret_env(runtime.cfg, step, runtime.secrets))
@@ -837,7 +855,16 @@ def make_command_node(runtime: Runtime, step: StepConfig):
                 step.command, runtime.workspace, timeout, env,
                 sandbox=sandbox, pipeline=runtime.cfg.name, step=step.name,
                 network=step.network, mount_set=mount_set,
-                egress_policy=egress_policy, cwd=cwd)
+                egress_policy=egress_policy, cwd=cwd, allowlist=allowlist)
+        except SandboxError:
+            err = redact_values(traceback.format_exc(),
+                                runtime.secrets.values())[-4000:]
+            print(err, file=sys.stderr, flush=True)
+            runtime.state_dir.mkdir(parents=True, exist_ok=True)
+            (runtime.state_dir / LAST_ERROR).write_text(
+                f"# Command step failed\n\n```\n{err}\n```\n",
+                encoding="utf-8")
+            return {"failed": True, "failed_step": step.name}
         except Exception:
             print(redact_values(traceback.format_exc(),
                                 runtime.secrets.values())[-4000:],
@@ -903,6 +930,8 @@ def make_action_node(runtime: Runtime, step: StepConfig):
     timeout = DEFAULT_COMMAND_TIMEOUT
     env = resolve_sandbox_env(step.env)
     cwd, mount_set, egress_policy = _step_sandbox(runtime, step)
+    allowlist = (tuple(runtime.engine_allowlist)
+                 if runtime.engine_allowlist is not None else None)
 
     def node(state: dict) -> dict:
         attempt = state["attempt"]
@@ -919,7 +948,17 @@ def make_action_node(runtime: Runtime, step: StepConfig):
             exit_code, output, timed_out = _run_command(
                 command, runtime.workspace, timeout, env, sandbox=runtime.sandbox,
                 pipeline=runtime.cfg.name, step=step.name, network=step.network,
-                mount_set=mount_set, egress_policy=egress_policy, cwd=cwd)
+                mount_set=mount_set, egress_policy=egress_policy, cwd=cwd,
+                allowlist=allowlist)
+        except SandboxError:
+            err = redact_values(traceback.format_exc(),
+                                runtime.secrets.values())[-4000:]
+            print(err, file=sys.stderr, flush=True)
+            runtime.state_dir.mkdir(parents=True, exist_ok=True)
+            (runtime.state_dir / LAST_ERROR).write_text(
+                f"# Action step failed\n\n```\n{err}\n```\n",
+                encoding="utf-8")
+            return {"failed": True, "failed_step": step.name}
         except Exception:
             print(redact_values(traceback.format_exc(),
                                 runtime.secrets.values())[-4000:],