agentic-dev-loop 1.0.0a34__tar.gz → 1.0.0a36__tar.gz

{agentic_dev_loop-1.0.0a34/src/agentic_dev_loop.egg-info → agentic_dev_loop-1.0.0a36}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentic-dev-loop
-Version: 1.0.0a34
+Version: 1.0.0a36
 Summary: Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase.
 Author: Luke Wilson
 License-Expression: Apache-2.0
@@ -242,7 +242,7 @@ steps:
 | `stop_when:` | Optional agent-step termination: `{ green_command: <argv regex>, post_green_turns: <int, default 2> }`. When the agent's most recent terminal observation matching `green_command` exits 0 and no workspace writes have happened since, the engine injects one nudge turn, allows `post_green_turns` further turns, then closes the conversation. Absent = run to finish. |
 | `terminal_timeout:` | Optional agent-step per-action timeout in seconds (gt 0). `SandboxTerminalExecutor` uses it when the agent leaves the terminal action timeout unset, overriding the SDK tool's default. `None` = current behavior. |
 | `finalize_nudge_turns:` | Optional agent-step final-response nudge (gt 0). Requires `max_iterations:` and must be less than it. At `max_iterations - finalize_nudge_turns` completed turns the engine injects one advisory turn ("`N turns remain: produce your final response now`"), exactly once; the agent may still exhaust its turns and existing stuck/unclear handling applies unchanged. Absent = current behavior. Provisional pending one consumer run (revert if noisy or the raised cap inflates cost). |
-| `custom_prompt:` | Planned (planning-docs/039). Optional agent-step value: literal text, or a path whose file contents are read at load time, appended verbatim to the agent prompt at context assembly (after the prompt, before the task/artifacts). A value that looks like a path but names no file is a validation error. Agent steps only. |
+| `custom_prompt:` | Planned (planning-docs/040). Optional agent-step value: literal text, or a path whose file contents are read at load time, appended verbatim to the agent prompt at context assembly (after the prompt, before the task/artifacts). A value that looks like a path but names no file is a validation error. Agent steps only. |
 | `on_pass:` / `on_fail:` | A step name, terminal `success`/`failure`, or `{goto: X, retry: true}`. No loops happen unless you write them. |
 | `env:` / `setup:` / `network:` | `env:` declares step vars (fixed safe base + declared vars only); `setup:` provisions the sandbox before the step runs (command or agent steps; network ON; stamp-cached, re-runs when the pipeline's lockfiles change); `network: true` lets a command/agent step reach the hosts its `egress:` allowlist names (default off) - see [Per-stage networking](#per-stage-networking). |
 | `mounts:` / `egress:` | Per-step workspace isolation. `mounts:` lists `{path, mode}` entries (`rw`/`ro`, default `ro`) and is **strict-by-default** - empty/missing mounts nothing; only declared-rw paths sync back to the repo. `egress:` is `{class, presets, targets}` (`class: browser` = broad-but-logged; otherwise a strict allowlist). See [Per-stage networking](#per-stage-networking) and [docs/setup.md](docs/setup.md). |

{agentic_dev_loop-1.0.0a34 → agentic_dev_loop-1.0.0a36}/README.md

@@ -200,7 +200,7 @@ steps:
 | `stop_when:` | Optional agent-step termination: `{ green_command: <argv regex>, post_green_turns: <int, default 2> }`. When the agent's most recent terminal observation matching `green_command` exits 0 and no workspace writes have happened since, the engine injects one nudge turn, allows `post_green_turns` further turns, then closes the conversation. Absent = run to finish. |
 | `terminal_timeout:` | Optional agent-step per-action timeout in seconds (gt 0). `SandboxTerminalExecutor` uses it when the agent leaves the terminal action timeout unset, overriding the SDK tool's default. `None` = current behavior. |
 | `finalize_nudge_turns:` | Optional agent-step final-response nudge (gt 0). Requires `max_iterations:` and must be less than it. At `max_iterations - finalize_nudge_turns` completed turns the engine injects one advisory turn ("`N turns remain: produce your final response now`"), exactly once; the agent may still exhaust its turns and existing stuck/unclear handling applies unchanged. Absent = current behavior. Provisional pending one consumer run (revert if noisy or the raised cap inflates cost). |
-| `custom_prompt:` | Planned (planning-docs/039). Optional agent-step value: literal text, or a path whose file contents are read at load time, appended verbatim to the agent prompt at context assembly (after the prompt, before the task/artifacts). A value that looks like a path but names no file is a validation error. Agent steps only. |
+| `custom_prompt:` | Planned (planning-docs/040). Optional agent-step value: literal text, or a path whose file contents are read at load time, appended verbatim to the agent prompt at context assembly (after the prompt, before the task/artifacts). A value that looks like a path but names no file is a validation error. Agent steps only. |
 | `on_pass:` / `on_fail:` | A step name, terminal `success`/`failure`, or `{goto: X, retry: true}`. No loops happen unless you write them. |
 | `env:` / `setup:` / `network:` | `env:` declares step vars (fixed safe base + declared vars only); `setup:` provisions the sandbox before the step runs (command or agent steps; network ON; stamp-cached, re-runs when the pipeline's lockfiles change); `network: true` lets a command/agent step reach the hosts its `egress:` allowlist names (default off) - see [Per-stage networking](#per-stage-networking). |
 | `mounts:` / `egress:` | Per-step workspace isolation. `mounts:` lists `{path, mode}` entries (`rw`/`ro`, default `ro`) and is **strict-by-default** - empty/missing mounts nothing; only declared-rw paths sync back to the repo. `egress:` is `{class, presets, targets}` (`class: browser` = broad-but-logged; otherwise a strict allowlist). See [Per-stage networking](#per-stage-networking) and [docs/setup.md](docs/setup.md). |

{agentic_dev_loop-1.0.0a34 → agentic_dev_loop-1.0.0a36}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agentic-dev-loop"
-version = "1.0.0a34"
+version = "1.0.0a36"
 description = "Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase."
 readme = "README.md"
 requires-python = ">=3.12"

{agentic_dev_loop-1.0.0a34 → agentic_dev_loop-1.0.0a36}/src/agentic_dev_loop/engine/agent_error_guide.md

@@ -4,3 +4,4 @@
 | AE-SBX-010 | The sandbox could not create the execution container for the command, so the command did not run. | The command is not the problem: retry once; if it persists, mention the code in your final response and stop. |
 | AE-SBX-016 | The loop refused to sync an edit because the real repo changed underneath on a path this workspace also touches; the file in this workspace is stale and its edits will not be applied. | The command is not the problem: retry once, do not edit or work around the named path, and mention the code in your final response if it persists. |
 | AE-SBX-018 | The network egress proxy for this step stopped, so the sandbox refused the command rather than run without enforcement. | The command is not the problem: do not retry it, mention the code in your final response, and stop. |
+| AE-SBX-020 | The sandbox could not start the network egress proxy for this step, so the command did not run. | The command is not the problem: retry once; if it persists, mention the code in your final response and stop. |

{agentic_dev_loop-1.0.0a34 → agentic_dev_loop-1.0.0a36}/src/agentic_dev_loop/engine/egress_policy.py

@@ -10,11 +10,6 @@ from __future__ import annotations
 
 from dataclasses import dataclass
 
-from agentic_dev_loop.core.config import (
-    EgressSpec, parse_egress_port, parse_egress_target,
-)
-from .presets import expand_presets
-
 ALLOWLIST = "allowlist"
 # The explicit broad-but-logged browser class (BR-7): no target filtering,
 # every connection logged host-side.
@@ -32,6 +27,7 @@ class TargetEntry:
 
     @classmethod
     def from_spec(cls, spec: str) -> "TargetEntry":
+        from agentic_dev_loop.core.config import parse_egress_target
         host, port = parse_egress_target(spec)
         return cls(host=host, port=port)
 
@@ -51,6 +47,7 @@ class EgressPolicy:
     policy_class: str = ALLOWLIST
 
     def to_spec(self) -> EgressSpec:
+        from agentic_dev_loop.core.config import EgressSpec
         cls = None if self.policy_class == ALLOWLIST else BROWSER
         return EgressSpec(
             class_=cls,
@@ -72,6 +69,7 @@ def assemble_egress_policy(egress: EgressSpec | None) -> EgressPolicy:
     cls = egress.class_ or ALLOWLIST
     if cls == BROWSER:
         return EgressPolicy(policy_class=BROWSER)
+    from .presets import expand_presets
     entries: list[TargetEntry] = []
     if egress.presets:
         for spec in expand_presets(egress.presets):
@@ -81,6 +79,18 @@ def assemble_egress_policy(egress: EgressSpec | None) -> EgressPolicy:
     return EgressPolicy(targets=tuple(entries), policy_class=ALLOWLIST)
 
 
+def _parse_port(spec: str, port: str) -> int | None:
+    """Validate a target port (BR-6.3), standalone-safe (no engine package)."""
+    if port == "":
+        raise ValueError(f"malformed egress target {spec!r}: empty port")
+    if not port.isdigit():
+        raise ValueError(f"malformed egress target {spec!r}: port {port!r} not numeric")
+    n = int(port)
+    if not 1 <= n <= 65535:
+        raise ValueError(f"malformed egress target {spec!r}: port {n} out of range")
+    return n
+
+
 def _split_host_port(hostname: str) -> tuple[str, int | None]:
     """Split a CONNECT target into (host, port). Bare hostnames carry no port."""
     value = hostname.strip()
@@ -91,7 +101,7 @@ def _split_host_port(hostname: str) -> tuple[str, int | None]:
         host = value[1:end]
         rest = value[end + 1:]
         if rest.startswith(":"):
-            return host, parse_egress_port(hostname, rest[1:])
+            return host, _parse_port(hostname, rest[1:])
         return host, None
     if value.count(":") == 1:
         host, port = value.rsplit(":", 1)

{agentic_dev_loop-1.0.0a34 → agentic_dev_loop-1.0.0a36}/src/agentic_dev_loop/engine/egress_proxy.py

@@ -8,13 +8,20 @@ request hostname (CONNECT target) per connection against the expanded policy
 
 from __future__ import annotations
 
+import argparse
 import asyncio
+import json
+import sys
 import threading
 from dataclasses import dataclass, field
 from datetime import datetime, timezone
+from pathlib import Path
 from urllib.parse import urlsplit
 
-from .egress_policy import EgressPolicy, match_target
+if __package__:
+    from .egress_policy import EgressPolicy, TargetEntry, match_target
+else:  # standalone container-mode entrypoint (run as a script)
+    from egress_policy import EgressPolicy, TargetEntry, match_target
 
 
 @dataclass(frozen=True)
@@ -33,6 +40,8 @@ class EgressProxy:
 
     policy: EgressPolicy
     events: list[EnforcementEvent] = field(default_factory=list)
+    dial_rewrites: dict[str, str] = field(default_factory=dict)
+    event_file: Path | None = None
 
     def __post_init__(self) -> None:
         self._server: asyncio.AbstractServer | None = None
@@ -138,7 +147,7 @@ class EgressProxy:
         # upstream answers with a decode alert - the restore step's SSL
         # TLSV1_ALERT_DECODE_ERROR).
         await _drain_headers(reader)
-        conn = await _open(host, port)
+        conn = await self._open(host, port)
         if conn is None:
             _write(writer, b"HTTP/1.1 502 Bad Gateway\r\nContent-Length: 0\r\n\r\n")
             return
@@ -159,7 +168,7 @@ class EgressProxy:
             _write(writer, b"HTTP/1.1 403 Forbidden\r\nContent-Length: 0\r\n\r\n")
             return
         self._record(host, True)
-        conn = await _open(host, port)
+        conn = await self._open(host, port)
         if conn is None:
             _write(writer, b"HTTP/1.1 502 Bad Gateway\r\nContent-Length: 0\r\n\r\n")
             return
@@ -174,9 +183,23 @@ class EgressProxy:
         await _relay_both(reader, writer, upstream_reader, upstream_writer)
 
     def _record(self, hostname: str, allowed: bool) -> None:
-        self.events.append(EnforcementEvent(
+        event = EnforcementEvent(
             hostname=hostname, allowed=allowed,
-            timestamp=datetime.now(timezone.utc).isoformat()))
+            timestamp=datetime.now(timezone.utc).isoformat())
+        self.events.append(event)
+        if self.event_file is not None:
+            _append_event_file(self.event_file, event)
+
+    async def _open(self, host: str, port: int):
+        """Dial the upstream, applying the configured dial rewrite (D8).
+        ``match_target`` already ran against the original hostname, and the
+        request/Host header keep that hostname; only the upstream dial address
+        is rewritten."""
+        dial_host = self.dial_rewrites.get(host, host)
+        try:
+            return await asyncio.open_connection(dial_host, port)
+        except OSError:
+            return None
 
 
 def _parse_request_line(line: bytes) -> tuple[str, str, str]:
@@ -207,12 +230,6 @@ def _write(writer: asyncio.StreamWriter, data: bytes) -> None:
     writer.write(data)
 
 
-async def _open(host: str, port: int):
-    try:
-        return await asyncio.open_connection(host, port)
-    except OSError:
-        return None
-
 
 async def _forward_headers(reader, upstream, host: str) -> None:
     saw_host = False
@@ -262,3 +279,63 @@ async def _relay(src, dst) -> None:
             dst.write_eof()
         except Exception:
             pass
+
+
+
+def _append_event_file(path: Path, event: EnforcementEvent) -> None:
+    """Append one enforcement event to the mounted JSONL file (best-effort:
+    a broken events file must never break enforcement)."""
+    record = {
+        "hostname": event.hostname,
+        "allowed": event.allowed,
+        "timestamp": event.timestamp,
+    }
+    try:
+        with path.open("a", encoding="utf-8") as fh:
+            fh.write(json.dumps(record, sort_keys=True) + "\n")
+    except OSError:
+        pass
+
+
+def policy_to_json(policy: EgressPolicy) -> str:
+    """Serialize a resolved policy for the container-mode entrypoint."""
+    return json.dumps({
+        "class": policy.policy_class,
+        "targets": [{"host": t.host, "port": t.port} for t in policy.targets],
+    }, sort_keys=True)
+
+
+def policy_from_json(text: str) -> EgressPolicy:
+    """Rebuild a resolved policy from the entrypoint's ``--policy`` JSON."""
+    data = json.loads(text)
+    return EgressPolicy(
+        targets=tuple(
+            TargetEntry(host=t["host"], port=t.get("port"))
+            for t in data.get("targets", [])),
+        policy_class=data.get("class", "allowlist"),
+    )
+
+
+def main(argv: list[str] | None = None) -> int:
+    """Container-mode entrypoint: serve the policy on the internal network
+    and append enforcement events to a mounted file until SIGTERM."""
+    parser = argparse.ArgumentParser(description="agentic-dev-loop egress proxy")
+    parser.add_argument("--policy", required=True)
+    parser.add_argument("--events", required=True)
+    parser.add_argument("--dial-rewrites", default="{}")
+    parser.add_argument("--host", default="0.0.0.0")
+    parser.add_argument("--port", type=int, default=0)
+    args = parser.parse_args(argv)
+
+    proxy = EgressProxy(
+        policy=policy_from_json(args.policy),
+        dial_rewrites=json.loads(args.dial_rewrites),
+        event_file=Path(args.events),
+    )
+    proxy.start(host=args.host, port=args.port)
+    threading.Event().wait()
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())