agentic-dev-loop 1.0.0a35__tar.gz → 1.0.0a37__tar.gz

{agentic_dev_loop-1.0.0a35/src/agentic_dev_loop.egg-info → agentic_dev_loop-1.0.0a37}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentic-dev-loop
-Version: 1.0.0a35
+Version: 1.0.0a37
 Summary: Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase.
 Author: Luke Wilson
 License-Expression: Apache-2.0
@@ -242,7 +242,7 @@ steps:
 | `stop_when:` | Optional agent-step termination: `{ green_command: <argv regex>, post_green_turns: <int, default 2> }`. When the agent's most recent terminal observation matching `green_command` exits 0 and no workspace writes have happened since, the engine injects one nudge turn, allows `post_green_turns` further turns, then closes the conversation. Absent = run to finish. |
 | `terminal_timeout:` | Optional agent-step per-action timeout in seconds (gt 0). `SandboxTerminalExecutor` uses it when the agent leaves the terminal action timeout unset, overriding the SDK tool's default. `None` = current behavior. |
 | `finalize_nudge_turns:` | Optional agent-step final-response nudge (gt 0). Requires `max_iterations:` and must be less than it. At `max_iterations - finalize_nudge_turns` completed turns the engine injects one advisory turn ("`N turns remain: produce your final response now`"), exactly once; the agent may still exhaust its turns and existing stuck/unclear handling applies unchanged. Absent = current behavior. Provisional pending one consumer run (revert if noisy or the raised cap inflates cost). |
-| `custom_prompt:` | Planned (planning-docs/039). Optional agent-step value: literal text, or a path whose file contents are read at load time, appended verbatim to the agent prompt at context assembly (after the prompt, before the task/artifacts). A value that looks like a path but names no file is a validation error. Agent steps only. |
+| `custom_prompt:` | Planned (planning-docs/040). Optional agent-step value: literal text, or a path whose file contents are read at load time, appended verbatim to the agent prompt at context assembly (after the prompt, before the task/artifacts). A value that looks like a path but names no file is a validation error. Agent steps only. |
 | `on_pass:` / `on_fail:` | A step name, terminal `success`/`failure`, or `{goto: X, retry: true}`. No loops happen unless you write them. |
 | `env:` / `setup:` / `network:` | `env:` declares step vars (fixed safe base + declared vars only); `setup:` provisions the sandbox before the step runs (command or agent steps; network ON; stamp-cached, re-runs when the pipeline's lockfiles change); `network: true` lets a command/agent step reach the hosts its `egress:` allowlist names (default off) - see [Per-stage networking](#per-stage-networking). |
 | `mounts:` / `egress:` | Per-step workspace isolation. `mounts:` lists `{path, mode}` entries (`rw`/`ro`, default `ro`) and is **strict-by-default** - empty/missing mounts nothing; only declared-rw paths sync back to the repo. `egress:` is `{class, presets, targets}` (`class: browser` = broad-but-logged; otherwise a strict allowlist). See [Per-stage networking](#per-stage-networking) and [docs/setup.md](docs/setup.md). |
@@ -328,11 +328,13 @@ steps:
   a command like `curl ... -o spec.json` has no writable cwd to write into.
   Declare `mounts: [{ path: ".", mode: rw }]` (or a narrower rw path) for any
   networked step that needs to produce files.
-- **`network: true` is now scoped by the `egress:` allowlist.** A networked
-  step's traffic is forced through an engine-run per-policy egress proxy
-  (injected via `HTTP_PROXY`/`HTTPS_PROXY` and reached through the
-  `host.docker.internal` host-gateway); a request to an undeclared host is
-  denied and logged as an enforcement event. The engine never adds an
+- **`network: true` is scoped by the `egress:` allowlist, and egress is
+  structurally enforced.** A networked step runs on a per-run internal
+  docker network with no route to the host. Its traffic is forced
+  through a containerized egress proxy (injected via
+  `HTTP_PROXY`/`HTTPS_PROXY`, pointed at the proxy container's DNS name
+  on the internal network); a request to an undeclared host is denied
+  and logged as an enforcement event. The engine never adds an
   undeclared target. `egress: { class: browser }` is the explicit
   broad-but-logged class (every connection logged, nothing filtered); command
   and agent steps default to a strict allowlist.
@@ -342,16 +344,16 @@ steps:
   to exactly the declared hosts for that stage; the default stays network-off
   everywhere. Reserve it for stages that need it (QA, integration). The
   residual risks are documented in [docs/setup.md](docs/setup.md).
-- **Host-service reachability (planned - planning-docs/037, 038).** A host
-  service reached at `host.docker.internal` through the proxy fails today:
-  the policy admits it, but the proxy dials from the host, where that
-  container-only name does not resolve (a 502 for the client). 037 rewrites
-  `host.docker.internal` to host loopback at the proxy dial site, so signed
-  host-service traffic (an S3 SDK against a local MinIO, say) reaches the
-  host through the enforced, logged path. 038 then replaces the
-  host-gateway model with a per-run internal network: sandboxes get no host
-  route, and a containerized proxy on a second host-access network is the
-  only egress path.
+- **Host-service reachability (planning-docs/037, 038).** The egress
+  proxy is a container on the run's internal network with a second
+  host-access attachment carrying the `host.docker.internal`
+  host-gateway alias, so the name resolves natively inside the proxy
+  container and host services (an S3 SDK against a local MinIO, say)
+  are reached through the enforced, logged path. Sandbox containers
+  have no host route: the internal network carries no default route to
+  the host, and sandbox containers get no host-gateway alias.
+  `dial_rewrites` on the proxy remains the platform override for hosts
+  where the alias does not resolve.
 
 ### Sync-back conflicts (host edits during a run)
 

{agentic_dev_loop-1.0.0a35 → agentic_dev_loop-1.0.0a37}/README.md

@@ -200,7 +200,7 @@ steps:
 | `stop_when:` | Optional agent-step termination: `{ green_command: <argv regex>, post_green_turns: <int, default 2> }`. When the agent's most recent terminal observation matching `green_command` exits 0 and no workspace writes have happened since, the engine injects one nudge turn, allows `post_green_turns` further turns, then closes the conversation. Absent = run to finish. |
 | `terminal_timeout:` | Optional agent-step per-action timeout in seconds (gt 0). `SandboxTerminalExecutor` uses it when the agent leaves the terminal action timeout unset, overriding the SDK tool's default. `None` = current behavior. |
 | `finalize_nudge_turns:` | Optional agent-step final-response nudge (gt 0). Requires `max_iterations:` and must be less than it. At `max_iterations - finalize_nudge_turns` completed turns the engine injects one advisory turn ("`N turns remain: produce your final response now`"), exactly once; the agent may still exhaust its turns and existing stuck/unclear handling applies unchanged. Absent = current behavior. Provisional pending one consumer run (revert if noisy or the raised cap inflates cost). |
-| `custom_prompt:` | Planned (planning-docs/039). Optional agent-step value: literal text, or a path whose file contents are read at load time, appended verbatim to the agent prompt at context assembly (after the prompt, before the task/artifacts). A value that looks like a path but names no file is a validation error. Agent steps only. |
+| `custom_prompt:` | Planned (planning-docs/040). Optional agent-step value: literal text, or a path whose file contents are read at load time, appended verbatim to the agent prompt at context assembly (after the prompt, before the task/artifacts). A value that looks like a path but names no file is a validation error. Agent steps only. |
 | `on_pass:` / `on_fail:` | A step name, terminal `success`/`failure`, or `{goto: X, retry: true}`. No loops happen unless you write them. |
 | `env:` / `setup:` / `network:` | `env:` declares step vars (fixed safe base + declared vars only); `setup:` provisions the sandbox before the step runs (command or agent steps; network ON; stamp-cached, re-runs when the pipeline's lockfiles change); `network: true` lets a command/agent step reach the hosts its `egress:` allowlist names (default off) - see [Per-stage networking](#per-stage-networking). |
 | `mounts:` / `egress:` | Per-step workspace isolation. `mounts:` lists `{path, mode}` entries (`rw`/`ro`, default `ro`) and is **strict-by-default** - empty/missing mounts nothing; only declared-rw paths sync back to the repo. `egress:` is `{class, presets, targets}` (`class: browser` = broad-but-logged; otherwise a strict allowlist). See [Per-stage networking](#per-stage-networking) and [docs/setup.md](docs/setup.md). |
@@ -286,11 +286,13 @@ steps:
   a command like `curl ... -o spec.json` has no writable cwd to write into.
   Declare `mounts: [{ path: ".", mode: rw }]` (or a narrower rw path) for any
   networked step that needs to produce files.
-- **`network: true` is now scoped by the `egress:` allowlist.** A networked
-  step's traffic is forced through an engine-run per-policy egress proxy
-  (injected via `HTTP_PROXY`/`HTTPS_PROXY` and reached through the
-  `host.docker.internal` host-gateway); a request to an undeclared host is
-  denied and logged as an enforcement event. The engine never adds an
+- **`network: true` is scoped by the `egress:` allowlist, and egress is
+  structurally enforced.** A networked step runs on a per-run internal
+  docker network with no route to the host. Its traffic is forced
+  through a containerized egress proxy (injected via
+  `HTTP_PROXY`/`HTTPS_PROXY`, pointed at the proxy container's DNS name
+  on the internal network); a request to an undeclared host is denied
+  and logged as an enforcement event. The engine never adds an
   undeclared target. `egress: { class: browser }` is the explicit
   broad-but-logged class (every connection logged, nothing filtered); command
   and agent steps default to a strict allowlist.
@@ -300,16 +302,16 @@ steps:
   to exactly the declared hosts for that stage; the default stays network-off
   everywhere. Reserve it for stages that need it (QA, integration). The
   residual risks are documented in [docs/setup.md](docs/setup.md).
-- **Host-service reachability (planned - planning-docs/037, 038).** A host
-  service reached at `host.docker.internal` through the proxy fails today:
-  the policy admits it, but the proxy dials from the host, where that
-  container-only name does not resolve (a 502 for the client). 037 rewrites
-  `host.docker.internal` to host loopback at the proxy dial site, so signed
-  host-service traffic (an S3 SDK against a local MinIO, say) reaches the
-  host through the enforced, logged path. 038 then replaces the
-  host-gateway model with a per-run internal network: sandboxes get no host
-  route, and a containerized proxy on a second host-access network is the
-  only egress path.
+- **Host-service reachability (planning-docs/037, 038).** The egress
+  proxy is a container on the run's internal network with a second
+  host-access attachment carrying the `host.docker.internal`
+  host-gateway alias, so the name resolves natively inside the proxy
+  container and host services (an S3 SDK against a local MinIO, say)
+  are reached through the enforced, logged path. Sandbox containers
+  have no host route: the internal network carries no default route to
+  the host, and sandbox containers get no host-gateway alias.
+  `dial_rewrites` on the proxy remains the platform override for hosts
+  where the alias does not resolve.
 
 ### Sync-back conflicts (host edits during a run)
 

{agentic_dev_loop-1.0.0a35 → agentic_dev_loop-1.0.0a37}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agentic-dev-loop"
-version = "1.0.0a35"
+version = "1.0.0a37"
 description = "Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase."
 readme = "README.md"
 requires-python = ">=3.12"

{agentic_dev_loop-1.0.0a35 → agentic_dev_loop-1.0.0a37}/src/agentic_dev_loop/engine/agent_error_guide.md

@@ -4,3 +4,4 @@
 | AE-SBX-010 | The sandbox could not create the execution container for the command, so the command did not run. | The command is not the problem: retry once; if it persists, mention the code in your final response and stop. |
 | AE-SBX-016 | The loop refused to sync an edit because the real repo changed underneath on a path this workspace also touches; the file in this workspace is stale and its edits will not be applied. | The command is not the problem: retry once, do not edit or work around the named path, and mention the code in your final response if it persists. |
 | AE-SBX-018 | The network egress proxy for this step stopped, so the sandbox refused the command rather than run without enforcement. | The command is not the problem: do not retry it, mention the code in your final response, and stop. |
+| AE-SBX-020 | The sandbox could not start the network egress proxy for this step, so the command did not run. | The command is not the problem: retry once; if it persists, mention the code in your final response and stop. |

{agentic_dev_loop-1.0.0a35 → agentic_dev_loop-1.0.0a37}/src/agentic_dev_loop/engine/egress_policy.py

@@ -10,11 +10,6 @@ from __future__ import annotations
 
 from dataclasses import dataclass
 
-from agentic_dev_loop.core.config import (
-    EgressSpec, parse_egress_port, parse_egress_target,
-)
-from .presets import expand_presets
-
 ALLOWLIST = "allowlist"
 # The explicit broad-but-logged browser class (BR-7): no target filtering,
 # every connection logged host-side.
@@ -32,6 +27,7 @@ class TargetEntry:
 
     @classmethod
     def from_spec(cls, spec: str) -> "TargetEntry":
+        from agentic_dev_loop.core.config import parse_egress_target
         host, port = parse_egress_target(spec)
         return cls(host=host, port=port)
 
@@ -51,6 +47,7 @@ class EgressPolicy:
     policy_class: str = ALLOWLIST
 
     def to_spec(self) -> EgressSpec:
+        from agentic_dev_loop.core.config import EgressSpec
         cls = None if self.policy_class == ALLOWLIST else BROWSER
         return EgressSpec(
             class_=cls,
@@ -72,6 +69,7 @@ def assemble_egress_policy(egress: EgressSpec | None) -> EgressPolicy:
     cls = egress.class_ or ALLOWLIST
     if cls == BROWSER:
         return EgressPolicy(policy_class=BROWSER)
+    from .presets import expand_presets
     entries: list[TargetEntry] = []
     if egress.presets:
         for spec in expand_presets(egress.presets):
@@ -81,6 +79,18 @@ def assemble_egress_policy(egress: EgressSpec | None) -> EgressPolicy:
     return EgressPolicy(targets=tuple(entries), policy_class=ALLOWLIST)
 
 
+def _parse_port(spec: str, port: str) -> int | None:
+    """Validate a target port (BR-6.3), standalone-safe (no engine package)."""
+    if port == "":
+        raise ValueError(f"malformed egress target {spec!r}: empty port")
+    if not port.isdigit():
+        raise ValueError(f"malformed egress target {spec!r}: port {port!r} not numeric")
+    n = int(port)
+    if not 1 <= n <= 65535:
+        raise ValueError(f"malformed egress target {spec!r}: port {n} out of range")
+    return n
+
+
 def _split_host_port(hostname: str) -> tuple[str, int | None]:
     """Split a CONNECT target into (host, port). Bare hostnames carry no port."""
     value = hostname.strip()
@@ -91,7 +101,7 @@ def _split_host_port(hostname: str) -> tuple[str, int | None]:
         host = value[1:end]
         rest = value[end + 1:]
         if rest.startswith(":"):
-            return host, parse_egress_port(hostname, rest[1:])
+            return host, _parse_port(hostname, rest[1:])
         return host, None
     if value.count(":") == 1:
         host, port = value.rsplit(":", 1)

{agentic_dev_loop-1.0.0a35 → agentic_dev_loop-1.0.0a37}/src/agentic_dev_loop/engine/egress_proxy.py

@@ -8,13 +8,21 @@ request hostname (CONNECT target) per connection against the expanded policy
 
 from __future__ import annotations
 
+import argparse
 import asyncio
+import json
+import sys
 import threading
+import time
 from dataclasses import dataclass, field
 from datetime import datetime, timezone
+from pathlib import Path
 from urllib.parse import urlsplit
 
-from .egress_policy import EgressPolicy, match_target
+if __package__:
+    from .egress_policy import EgressPolicy, TargetEntry, match_target
+else:  # standalone container-mode entrypoint (run as a script)
+    from egress_policy import EgressPolicy, TargetEntry, match_target
 
 
 @dataclass(frozen=True)
@@ -33,6 +41,8 @@ class EgressProxy:
 
     policy: EgressPolicy
     events: list[EnforcementEvent] = field(default_factory=list)
+    dial_rewrites: dict[str, str] = field(default_factory=dict)
+    event_file: Path | None = None
 
     def __post_init__(self) -> None:
         self._server: asyncio.AbstractServer | None = None
@@ -47,24 +57,40 @@ class EgressProxy:
         """True while the proxy's server thread is running."""
         return self._thread is not None and self._thread.is_alive()
 
-    def start(self, host: str = "127.0.0.1", port: int = 0) -> int:
+    def start(self, host: str = "127.0.0.1", port: int = 0,
+              bind_timeout: float = 5.0) -> int:
         """Bind the proxy on ``host:port`` (ephemeral when port=0) and serve
-        in a background thread. Returns the bound port."""
+        in a background thread. Returns the bound port.
+
+        ``bind_timeout`` bounds how long the bind may wait for the requested
+        address to appear (the container-mode entrypoint binds an
+        internal-network IP that is attached after the container starts)."""
         self._loop = asyncio.new_event_loop()
 
         def _run() -> None:
             asyncio.set_event_loop(self._loop)
-            self._server = self._loop.run_until_complete(
-                asyncio.start_server(self._handle, host, port))
+            deadline = time.monotonic() + bind_timeout
+            while True:
+                try:
+                    self._server = self._loop.run_until_complete(
+                        asyncio.start_server(self._handle, host, port))
+                    break
+                except OSError:
+                    if time.monotonic() >= deadline:
+                        raise
+                    time.sleep(0.1)
             self._port = self._server.sockets[0].getsockname()[1]
             self._loop.run_forever()
 
         self._thread = threading.Thread(target=_run, daemon=True)
         self._thread.start()
-        deadline = datetime.now().timestamp() + 5.0
+        deadline = datetime.now().timestamp() + bind_timeout + 1.0
         while self._port is None:
+            if not self._thread.is_alive():
+                raise RuntimeError("egress proxy failed to bind")
             if datetime.now().timestamp() > deadline:
-                raise RuntimeError("egress proxy failed to bind within 5s")
+                raise RuntimeError(
+                    f"egress proxy failed to bind within {bind_timeout}s")
             threading.Event().wait(0.01)
         return self._port
 
@@ -138,7 +164,7 @@ class EgressProxy:
         # upstream answers with a decode alert - the restore step's SSL
         # TLSV1_ALERT_DECODE_ERROR).
         await _drain_headers(reader)
-        conn = await _open(host, port)
+        conn = await self._open(host, port)
         if conn is None:
             _write(writer, b"HTTP/1.1 502 Bad Gateway\r\nContent-Length: 0\r\n\r\n")
             return
@@ -159,7 +185,7 @@ class EgressProxy:
             _write(writer, b"HTTP/1.1 403 Forbidden\r\nContent-Length: 0\r\n\r\n")
             return
         self._record(host, True)
-        conn = await _open(host, port)
+        conn = await self._open(host, port)
         if conn is None:
             _write(writer, b"HTTP/1.1 502 Bad Gateway\r\nContent-Length: 0\r\n\r\n")
             return
@@ -174,9 +200,23 @@ class EgressProxy:
         await _relay_both(reader, writer, upstream_reader, upstream_writer)
 
     def _record(self, hostname: str, allowed: bool) -> None:
-        self.events.append(EnforcementEvent(
+        event = EnforcementEvent(
             hostname=hostname, allowed=allowed,
-            timestamp=datetime.now(timezone.utc).isoformat()))
+            timestamp=datetime.now(timezone.utc).isoformat())
+        self.events.append(event)
+        if self.event_file is not None:
+            _append_event_file(self.event_file, event)
+
+    async def _open(self, host: str, port: int):
+        """Dial the upstream, applying the configured dial rewrite (D8).
+        ``match_target`` already ran against the original hostname, and the
+        request/Host header keep that hostname; only the upstream dial address
+        is rewritten."""
+        dial_host = self.dial_rewrites.get(host, host)
+        try:
+            return await asyncio.open_connection(dial_host, port)
+        except OSError:
+            return None
 
 
 def _parse_request_line(line: bytes) -> tuple[str, str, str]:
@@ -207,12 +247,6 @@ def _write(writer: asyncio.StreamWriter, data: bytes) -> None:
     writer.write(data)
 
 
-async def _open(host: str, port: int):
-    try:
-        return await asyncio.open_connection(host, port)
-    except OSError:
-        return None
-
 
 async def _forward_headers(reader, upstream, host: str) -> None:
     saw_host = False
@@ -262,3 +296,64 @@ async def _relay(src, dst) -> None:
             dst.write_eof()
         except Exception:
             pass
+
+
+
+def _append_event_file(path: Path, event: EnforcementEvent) -> None:
+    """Append one enforcement event to the mounted JSONL file (best-effort:
+    a broken events file must never break enforcement)."""
+    record = {
+        "hostname": event.hostname,
+        "allowed": event.allowed,
+        "timestamp": event.timestamp,
+    }
+    try:
+        with path.open("a", encoding="utf-8") as fh:
+            fh.write(json.dumps(record, sort_keys=True) + "\n")
+    except OSError:
+        pass
+
+
+def policy_to_json(policy: EgressPolicy) -> str:
+    """Serialize a resolved policy for the container-mode entrypoint."""
+    return json.dumps({
+        "class": policy.policy_class,
+        "targets": [{"host": t.host, "port": t.port} for t in policy.targets],
+    }, sort_keys=True)
+
+
+def policy_from_json(text: str) -> EgressPolicy:
+    """Rebuild a resolved policy from the entrypoint's ``--policy`` JSON."""
+    data = json.loads(text)
+    return EgressPolicy(
+        targets=tuple(
+            TargetEntry(host=t["host"], port=t.get("port"))
+            for t in data.get("targets", [])),
+        policy_class=data.get("class", "allowlist"),
+    )
+
+
+def main(argv: list[str] | None = None) -> int:
+    """Container-mode entrypoint: serve the policy on the internal network
+    and append enforcement events to a mounted file until SIGTERM."""
+    parser = argparse.ArgumentParser(description="agentic-dev-loop egress proxy")
+    parser.add_argument("--policy", required=True)
+    parser.add_argument("--events", required=True)
+    parser.add_argument("--dial-rewrites", default="{}")
+    parser.add_argument("--host", default="127.0.0.1")
+    parser.add_argument("--port", type=int, default=0)
+    parser.add_argument("--bind-timeout", type=float, default=5.0)
+    args = parser.parse_args(argv)
+
+    proxy = EgressProxy(
+        policy=policy_from_json(args.policy),
+        dial_rewrites=json.loads(args.dial_rewrites),
+        event_file=Path(args.events),
+    )
+    proxy.start(host=args.host, port=args.port, bind_timeout=args.bind_timeout)
+    threading.Event().wait()
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())