agentic-dev-loop 1.0.0a36__tar.gz → 1.0.0a38__tar.gz

{agentic_dev_loop-1.0.0a36/src/agentic_dev_loop.egg-info → agentic_dev_loop-1.0.0a38}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentic-dev-loop
-Version: 1.0.0a36
+Version: 1.0.0a38
 Summary: Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase.
 Author: Luke Wilson
 License-Expression: Apache-2.0
@@ -328,11 +328,13 @@ steps:
   a command like `curl ... -o spec.json` has no writable cwd to write into.
   Declare `mounts: [{ path: ".", mode: rw }]` (or a narrower rw path) for any
   networked step that needs to produce files.
-- **`network: true` is now scoped by the `egress:` allowlist.** A networked
-  step's traffic is forced through an engine-run per-policy egress proxy
-  (injected via `HTTP_PROXY`/`HTTPS_PROXY` and reached through the
-  `host.docker.internal` host-gateway); a request to an undeclared host is
-  denied and logged as an enforcement event. The engine never adds an
+- **`network: true` is scoped by the `egress:` allowlist, and egress is
+  structurally enforced.** A networked step runs on a per-run internal
+  docker network with no route to the host. Its traffic is forced
+  through a containerized egress proxy (injected via
+  `HTTP_PROXY`/`HTTPS_PROXY`, pointed at the proxy container's DNS name
+  on the internal network); a request to an undeclared host is denied
+  and logged as an enforcement event. The engine never adds an
   undeclared target. `egress: { class: browser }` is the explicit
   broad-but-logged class (every connection logged, nothing filtered); command
   and agent steps default to a strict allowlist.
@@ -342,16 +344,16 @@ steps:
   to exactly the declared hosts for that stage; the default stays network-off
   everywhere. Reserve it for stages that need it (QA, integration). The
   residual risks are documented in [docs/setup.md](docs/setup.md).
-- **Host-service reachability (planned - planning-docs/037, 038).** A host
-  service reached at `host.docker.internal` through the proxy fails today:
-  the policy admits it, but the proxy dials from the host, where that
-  container-only name does not resolve (a 502 for the client). 037 rewrites
-  `host.docker.internal` to host loopback at the proxy dial site, so signed
-  host-service traffic (an S3 SDK against a local MinIO, say) reaches the
-  host through the enforced, logged path. 038 then replaces the
-  host-gateway model with a per-run internal network: sandboxes get no host
-  route, and a containerized proxy on a second host-access network is the
-  only egress path.
+- **Host-service reachability (planning-docs/037, 038).** The egress
+  proxy is a container on the run's internal network with a second
+  host-access attachment carrying the `host.docker.internal`
+  host-gateway alias, so the name resolves natively inside the proxy
+  container and host services (an S3 SDK against a local MinIO, say)
+  are reached through the enforced, logged path. Sandbox containers
+  have no host route: the internal network carries no default route to
+  the host, and sandbox containers get no host-gateway alias.
+  `dial_rewrites` on the proxy remains the platform override for hosts
+  where the alias does not resolve.
 
 ### Sync-back conflicts (host edits during a run)
 

{agentic_dev_loop-1.0.0a36 → agentic_dev_loop-1.0.0a38}/README.md

@@ -286,11 +286,13 @@ steps:
   a command like `curl ... -o spec.json` has no writable cwd to write into.
   Declare `mounts: [{ path: ".", mode: rw }]` (or a narrower rw path) for any
   networked step that needs to produce files.
-- **`network: true` is now scoped by the `egress:` allowlist.** A networked
-  step's traffic is forced through an engine-run per-policy egress proxy
-  (injected via `HTTP_PROXY`/`HTTPS_PROXY` and reached through the
-  `host.docker.internal` host-gateway); a request to an undeclared host is
-  denied and logged as an enforcement event. The engine never adds an
+- **`network: true` is scoped by the `egress:` allowlist, and egress is
+  structurally enforced.** A networked step runs on a per-run internal
+  docker network with no route to the host. Its traffic is forced
+  through a containerized egress proxy (injected via
+  `HTTP_PROXY`/`HTTPS_PROXY`, pointed at the proxy container's DNS name
+  on the internal network); a request to an undeclared host is denied
+  and logged as an enforcement event. The engine never adds an
   undeclared target. `egress: { class: browser }` is the explicit
   broad-but-logged class (every connection logged, nothing filtered); command
   and agent steps default to a strict allowlist.
@@ -300,16 +302,16 @@ steps:
   to exactly the declared hosts for that stage; the default stays network-off
   everywhere. Reserve it for stages that need it (QA, integration). The
   residual risks are documented in [docs/setup.md](docs/setup.md).
-- **Host-service reachability (planned - planning-docs/037, 038).** A host
-  service reached at `host.docker.internal` through the proxy fails today:
-  the policy admits it, but the proxy dials from the host, where that
-  container-only name does not resolve (a 502 for the client). 037 rewrites
-  `host.docker.internal` to host loopback at the proxy dial site, so signed
-  host-service traffic (an S3 SDK against a local MinIO, say) reaches the
-  host through the enforced, logged path. 038 then replaces the
-  host-gateway model with a per-run internal network: sandboxes get no host
-  route, and a containerized proxy on a second host-access network is the
-  only egress path.
+- **Host-service reachability (planning-docs/037, 038).** The egress
+  proxy is a container on the run's internal network with a second
+  host-access attachment carrying the `host.docker.internal`
+  host-gateway alias, so the name resolves natively inside the proxy
+  container and host services (an S3 SDK against a local MinIO, say)
+  are reached through the enforced, logged path. Sandbox containers
+  have no host route: the internal network carries no default route to
+  the host, and sandbox containers get no host-gateway alias.
+  `dial_rewrites` on the proxy remains the platform override for hosts
+  where the alias does not resolve.
 
 ### Sync-back conflicts (host edits during a run)
 

{agentic_dev_loop-1.0.0a36 → agentic_dev_loop-1.0.0a38}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agentic-dev-loop"
-version = "1.0.0a36"
+version = "1.0.0a38"
 description = "Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase."
 readme = "README.md"
 requires-python = ">=3.12"

{agentic_dev_loop-1.0.0a36 → agentic_dev_loop-1.0.0a38}/src/agentic_dev_loop/core/config.py

@@ -389,6 +389,7 @@ class StepConfig(BaseModel):
     stop_when: StopWhenSpec | None = None  # agent steps only (032)
     finalize_nudge_turns: int | None = Field(default=None, gt=0)  # agent steps only (035)
     brief_inputs: BriefInputsSpec | None = None  # agent steps only (033)
+    custom_prompt: str | None = None  # agent steps only (040); file path resolved at load
     env: dict[str, str | None] | None = None  # NFR-1: null = inherit host value
     setup: str | None = None  # BR-13: command steps only
     forbidden_commands: list[str] = []  # banned-command regex deny-list (036 D1)
@@ -441,6 +442,13 @@ class StepConfig(BaseModel):
                     f"regex: {e}") from e
         return v
 
+    @field_validator("custom_prompt")
+    @classmethod
+    def _nonempty_custom_prompt(cls, v: str | None) -> str | None:
+        if v is not None and not v.strip():
+            raise ValueError("custom_prompt must be a non-empty string")
+        return v
+
     @model_validator(mode="after")
     def _check_shape(self) -> "StepConfig":
         for key in ("agent", "action", "command"):
@@ -501,6 +509,10 @@ class StepConfig(BaseModel):
             raise ValueError(
                 f"step {self.name!r}: 'brief_inputs' requires 'agent'"
             )
+        if self.custom_prompt is not None and self.agent is None:
+            raise ValueError(
+                f"step {self.name!r}: 'custom_prompt' requires 'agent'"
+            )
         if (self.brief_inputs is not None
                 and (self.artifact is not None or self.verdicts is not None)):
             raise ValueError(
@@ -797,6 +809,28 @@ class PipelineConfig(BaseModel):
         return self
 
 
+def _custom_prompt_looks_like_path(value: str) -> bool:
+    """040/D2: a value counts as path-shaped when it carries a path
+    separator or a file extension (a dot). A path-shaped value that names no
+    existing file is a hard error, never silent text."""
+    return "/" in value or "\\" in value or Path(value).suffix != ""
+
+
+def resolve_custom_prompt(value: str, pipeline_dir: Path, step_name: str) -> str:
+    """Resolve a ``custom_prompt`` value (040/D2): an existing file
+    (relative to the pipeline's directory, or absolute) is read as the
+    prompt; any other value is literal text. A path-shaped value that names
+    no file fails loud, naming the path."""
+    candidate = Path(value)
+    path = candidate if candidate.is_absolute() else pipeline_dir / candidate
+    if path.is_file():
+        return path.read_text(encoding="utf-8")
+    if _custom_prompt_looks_like_path(value):
+        raise ValueError(
+            f"step {step_name!r}: 'custom_prompt' file not found: {value}")
+    return value
+
+
 def default_state_dir(pipeline_path: Path) -> str:
     """The new run-state default (Q1): checkpoint DB + last-error.md live OUTSIDE
     the workspace mount, under ~/.agentic-dev-loop/runs/<pipeline-hash>/ where
@@ -816,4 +850,10 @@ def load_config(path: Path) -> PipelineConfig:
         )
     if "state_dir" not in data:
         data["state_dir"] = default_state_dir(path)
-    return PipelineConfig.model_validate(data)
+    cfg = PipelineConfig.model_validate(data)
+    pipeline_dir = path.resolve().parent
+    for step in cfg.steps:
+        if step.custom_prompt is not None:
+            step.custom_prompt = resolve_custom_prompt(
+                step.custom_prompt, pipeline_dir, step.name)
+    return cfg

{agentic_dev_loop-1.0.0a36 → agentic_dev_loop-1.0.0a38}/src/agentic_dev_loop/engine/egress_proxy.py

@@ -13,6 +13,7 @@ import asyncio
 import json
 import sys
 import threading
+import time
 from dataclasses import dataclass, field
 from datetime import datetime, timezone
 from pathlib import Path
@@ -56,24 +57,40 @@ class EgressProxy:
         """True while the proxy's server thread is running."""
         return self._thread is not None and self._thread.is_alive()
 
-    def start(self, host: str = "127.0.0.1", port: int = 0) -> int:
+    def start(self, host: str = "127.0.0.1", port: int = 0,
+              bind_timeout: float = 5.0) -> int:
         """Bind the proxy on ``host:port`` (ephemeral when port=0) and serve
-        in a background thread. Returns the bound port."""
+        in a background thread. Returns the bound port.
+
+        ``bind_timeout`` bounds how long the bind may wait for the requested
+        address to appear (the container-mode entrypoint binds an
+        internal-network IP that is attached after the container starts)."""
         self._loop = asyncio.new_event_loop()
 
         def _run() -> None:
             asyncio.set_event_loop(self._loop)
-            self._server = self._loop.run_until_complete(
-                asyncio.start_server(self._handle, host, port))
+            deadline = time.monotonic() + bind_timeout
+            while True:
+                try:
+                    self._server = self._loop.run_until_complete(
+                        asyncio.start_server(self._handle, host, port))
+                    break
+                except OSError:
+                    if time.monotonic() >= deadline:
+                        raise
+                    time.sleep(0.1)
             self._port = self._server.sockets[0].getsockname()[1]
             self._loop.run_forever()
 
         self._thread = threading.Thread(target=_run, daemon=True)
         self._thread.start()
-        deadline = datetime.now().timestamp() + 5.0
+        deadline = datetime.now().timestamp() + bind_timeout + 1.0
         while self._port is None:
+            if not self._thread.is_alive():
+                raise RuntimeError("egress proxy failed to bind")
             if datetime.now().timestamp() > deadline:
-                raise RuntimeError("egress proxy failed to bind within 5s")
+                raise RuntimeError(
+                    f"egress proxy failed to bind within {bind_timeout}s")
             threading.Event().wait(0.01)
         return self._port
 
@@ -323,8 +340,9 @@ def main(argv: list[str] | None = None) -> int:
     parser.add_argument("--policy", required=True)
     parser.add_argument("--events", required=True)
     parser.add_argument("--dial-rewrites", default="{}")
-    parser.add_argument("--host", default="0.0.0.0")
+    parser.add_argument("--host", default="127.0.0.1")
     parser.add_argument("--port", type=int, default=0)
+    parser.add_argument("--bind-timeout", type=float, default=5.0)
     args = parser.parse_args(argv)
 
     proxy = EgressProxy(
@@ -332,7 +350,7 @@ def main(argv: list[str] | None = None) -> int:
         dial_rewrites=json.loads(args.dial_rewrites),
         event_file=Path(args.events),
     )
-    proxy.start(host=args.host, port=args.port)
+    proxy.start(host=args.host, port=args.port, bind_timeout=args.bind_timeout)
     threading.Event().wait()
     return 0
 

{agentic_dev_loop-1.0.0a36 → agentic_dev_loop-1.0.0a38}/src/agentic_dev_loop/engine/isolation.py

@@ -19,6 +19,7 @@ last-error.md) are never mounted - sandboxed code cannot reach them.
 from __future__ import annotations
 
 import hashlib
+import ipaddress
 import json
 import math
 import os
@@ -103,6 +104,14 @@ EGRESS_PROXY_PORT = 3128
 HOST_ACCESS_NETWORK = "bridge"
 EGRESS_EVENTS_PREFIX = "egress-events"
 
+# 039: hardened proxy-container runtime posture and readiness bounds.
+PROXY_USER = "65534:65534"
+PROXY_MEMORY = "64m"
+PROXY_CPUS = 0.5
+PROXY_BIND_TIMEOUT = 15.0
+PROXY_READY_ATTEMPTS = 5
+PROXY_READY_DELAY = 0.2
+
 
 class SandboxError(RuntimeError):
     """A loud fail-fast sandbox failure; the message names the problem and
@@ -301,6 +310,37 @@ def egress_events_path(iso_state_dir: str | Path, run_id: str) -> Path:
     return Path(iso_state_dir) / f"{EGRESS_EVENTS_PREFIX}-{run_id}.jsonl"
 
 
+def first_usable_ip(subnets: str) -> str | None:
+    """First usable non-gateway IPv4 address from one or more CIDR subnets."""
+    for token in subnets.split():
+        try:
+            network = ipaddress.ip_network(token, strict=False)
+        except ValueError:
+            continue
+        if network.version != 4:
+            continue
+        hosts = list(network.hosts())
+        if len(hosts) < 2:
+            continue
+        return str(hosts[1])
+    return None
+
+
+
+def proxy_readiness_argv(name: str, host: str,
+                         port: int = EGRESS_PROXY_PORT) -> list[str]:
+    """The in-container TCP-connect probe for proxy readiness (039, D2)."""
+    probe = (
+        "import socket,sys;"
+        "s=socket.socket();"
+        "s.settimeout(2);"
+        "s.connect((sys.argv[1], int(sys.argv[2])));"
+        "s.close()"
+    )
+    return ["docker", "exec", name, "python3", "-c", probe, host, str(port)]
+
+
+
 def mount_set_docker_flags(export_root: str, mount_set: MountSet) -> list[str]:
     """Translate a resolved MountSet into Docker ``-v`` flags over the
     export (ID-4/BR-1). Strict-by-default: an empty mount set mounts nothing
@@ -730,12 +770,16 @@ def docker_proxy_payload(*, run_id: str, image: str, name: str,
                          events_host_path: str,
                          egress_proxy_host_path: str,
                          egress_policy_host_path: str,
+                         bind_host: str,
                          port: int = EGRESS_PROXY_PORT,
                          host_network: str = HOST_ACCESS_NETWORK) -> list[str]:
-    """Exact argv for the containerized egress proxy (038, D2/D5). It is
-    created on the host-access network with a host-gateway mapping (D8), then
-    attached to the internal network so sandbox containers reach it only via
-    its internal DNS name. The policy is passed as JSON; the two engine
+    """Exact argv for the containerized egress proxy (038 D2/D5, 039 D1/D4).
+
+    Created on the host-access network with a host-gateway mapping (D8), then
+    attached to the internal network with the pinned ``bind_host``; the proxy
+    binds that internal address only, so the host-access attachment carries no
+    listener. Hardened with a read-only rootfs, dropped capabilities, a non-root
+    user, and memory/CPU limits. The policy is passed as JSON; the two engine
     modules are bind-mounted read-only so the image does not need the engine
     package installed."""
     payload = [
@@ -744,6 +788,10 @@ def docker_proxy_payload(*, run_id: str, image: str, name: str,
         "--label", f"agentic-dev-loop.run={run_id}",
         "--network", host_network,
         "--add-host", "host.docker.internal:host-gateway",
+        "--read-only",
+        "--cap-drop", "ALL",
+        "--user", PROXY_USER,
+        "--memory", PROXY_MEMORY, "--cpus", str(PROXY_CPUS),
         "-v", f"{egress_proxy_host_path}:/egress/egress_proxy.py:ro",
         "-v", f"{egress_policy_host_path}:/egress/egress_policy.py:ro",
         "-v", f"{events_host_path}:/egress/events.jsonl",
@@ -753,11 +801,13 @@ def docker_proxy_payload(*, run_id: str, image: str, name: str,
         "--policy", policy_json,
         "--events", "/egress/events.jsonl",
         "--dial-rewrites", dial_rewrites_json,
-        "--host", "0.0.0.0",
+        "--host", bind_host,
+        "--bind-timeout", str(PROXY_BIND_TIMEOUT),
         "--port", str(port),
     ]
     return payload
 
+
 def docker_provision_payload(*, run_id: str, image: str, workspace: str,
                              setup_cmd: str,
                              sandbox_venv_dir: str | None = None,
@@ -891,7 +941,8 @@ class DockerBackend(Sandbox):
                  export_root: str | None = None,
                  cache_mounts: list[tuple[str, str, str]] | None = None,
                  sync_excludes: list[str] | None = None,
-                 merge_on_conflict: list[str] | None = None):
+                 merge_on_conflict: list[str] | None = None,
+                 dial_rewrites: dict[str, str] | None = None):
         self._image = image
         self._workspace = workspace
         self._iso_state_dir = Path(iso_state_dir)  # host-only (audit)
@@ -927,6 +978,7 @@ class DockerBackend(Sandbox):
         # 029: append-style logs union-merged on a concurrent-edit conflict
         # instead of raising (host wins, export-only lines appended).
         self._merge_on_conflict = list(merge_on_conflict or ())
+        self._dial_rewrites = dict(dial_rewrites or {})
         self._baseline: dict[str, str] = {}
         # The profile-keyed pool (D-1/BR-10): profile key -> running container.
         self._pool: dict[tuple[str, bool], _ProfileContainer] = {}
@@ -1154,11 +1206,6 @@ class DockerBackend(Sandbox):
         if prof is None:
             prof = self._start_profile(key, mount_set, policy, request.network)
             self._pool[key] = prof
-        if request.network and not prof.started:
-            raise SandboxError(
-                "AE-SBX-013: networked execution requested but no networked "
-                "container is running - declare `network: true` on the step "
-                "(docs/setup.md §3)")
         if request.network:
             if prof.proxy_name is None:
                 raise SandboxError(
@@ -1238,7 +1285,8 @@ class DockerBackend(Sandbox):
         proxy_url_value: str | None = None
         if network and self._export_root is not None:
             proxy_name = proxy_container_name(self._run_id, key[0][:16])
-            self._start_proxy_container(proxy_name, policy)
+            self._start_proxy_container(proxy_name, policy,
+                                         self._dial_rewrites)
             proxy_url_value = proxy_url(proxy_name)
         payload = docker_create_payload(
             run_id=self._run_id, image=self._image, profile=self._profile,
@@ -1261,37 +1309,81 @@ class DockerBackend(Sandbox):
                                  egress_policy=policy, proxy_name=proxy_name,
                                  started=True)
 
-    def _start_proxy_container(self, name: str, policy: EgressPolicy) -> None:
-        """Create one containerized proxy (038, D2/D5): host-access network
-        at create time, then attach the internal network; the events file is
-        pre-created so the single-file bind mount is a file, not a dir."""
+    def _start_proxy_container(self, name: str, policy: EgressPolicy,
+                               dial_rewrites: dict[str, str] | None = None) -> None:
+        """Create one containerized proxy (038 D2/D5, 039 D1-D4): host-access
+        network at create time with a pinned internal IP, then attach the internal
+        network; the proxy binds that address only and is readiness probed from
+        inside the container before the first sandbox exec (D2)."""
         self._ensure_run_network()
         events_host = self._egress_events_path
         events_host.parent.mkdir(parents=True, exist_ok=True)
         events_host.touch(exist_ok=True)
+        try:
+            os.chmod(events_host, 0o666)
+        except OSError:
+            pass
         policy_json = egress_proxy_module.policy_to_json(policy)
+        dial_rewrites = dict(dial_rewrites or {})
+        dial_rewrites_json = json.dumps(dial_rewrites, sort_keys=True)
+        bind_host = self._proxy_internal_ip()
         payload = docker_proxy_payload(
             run_id=self._run_id, image=self._image, name=name,
-            policy_json=policy_json, dial_rewrites_json="{}",
+            policy_json=policy_json, dial_rewrites_json=dial_rewrites_json,
             events_host_path=str(events_host),
             egress_proxy_host_path=str(Path(egress_proxy_module.__file__)),
             egress_policy_host_path=str(Path(egress_policy_module.__file__)),
-            port=EGRESS_PROXY_PORT)
+            bind_host=bind_host, port=EGRESS_PROXY_PORT)
         res = self._runner.run(payload, timeout=60)
         if res.exit_code != 0:
             raise SandboxError(
                 f"AE-SBX-020: egress proxy container run failed: "
                 f"{res.stderr.strip() or res.stdout.strip()}")
         connect = self._runner.run(
-            ["docker", "network", "connect", self._run_net, name], timeout=60)
+            ["docker", "network", "connect", "--ip", bind_host,
+             self._run_net, name], timeout=60)
         if connect.exit_code != 0:
             self._rm_container(name)
             raise SandboxError(
                 f"AE-SBX-020: egress proxy network attach failed: "
                 f"{connect.stderr.strip() or connect.stdout.strip()}")
+        if not self._wait_proxy_ready(name, bind_host):
+            self._rm_container(name)
+            raise SandboxError(
+                f"AE-SBX-021: egress proxy failed to bind "
+                f"{bind_host}:{EGRESS_PROXY_PORT} after "
+                f"{PROXY_READY_ATTEMPTS} readiness probes")
         self._register_container(name)
         self._proxy_containers.append(name)
 
+    def _proxy_internal_ip(self) -> str:
+        """Return the pinned first-usable IPv4 address on the internal network."""
+        inspect = self._runner.run(
+            ["docker", "network", "inspect", "-f",
+             "{{range .IPAM.Config}}{{.Subnet}} {{end}}", self._run_net],
+            timeout=30)
+        if inspect.exit_code != 0:
+            raise SandboxError(
+                f"AE-SBX-021: internal network inspect failed: "
+                f"{inspect.stderr.strip() or inspect.stdout.strip()}")
+        ip = first_usable_ip(inspect.stdout)
+        if ip is None:
+            raise SandboxError(
+                f"AE-SBX-021: internal network has no usable IPv4 subnet: "
+                f"{inspect.stdout.strip()!r}")
+        return ip
+
+    def _wait_proxy_ready(self, name: str, host: str) -> bool:
+        """Bounded in-container TCP-connect readiness probe (039 D2)."""
+        for _ in range(PROXY_READY_ATTEMPTS):
+            res = self._runner.run(proxy_readiness_argv(name, host),
+                                   timeout=15)
+            if res.exit_code == 0:
+                return True
+            time.sleep(PROXY_READY_DELAY)
+        return False
+
+
     def _proxy_alive(self, name: str) -> bool:
         """Query the daemon for proxy liveness (038 AE-SBX-018)."""
         res = self._runner.run(
@@ -1809,7 +1901,8 @@ def _announce(msg: str) -> None:
 def startup_sandbox(cfg: PipelineConfig, *, workspace: Path,
                     state_dir: str | Path,
                     runner: CommandRunner | None = None,
-                    refresh: bool | None = None) -> Sandbox:
+                    refresh: bool | None = None,
+                    dial_rewrites: dict[str, str] | None = None) -> Sandbox:
     """Eager startup sequence (Q2): probe → image → materialise export →
     backend → ensure_image → create+start → pre-provision every declared setup
     (stamp-cached).
@@ -1866,7 +1959,8 @@ def startup_sandbox(cfg: PipelineConfig, *, workspace: Path,
         sandbox_venv_dir=sandbox_venv_dir, seccomp_profile=seccomp_profile,
         export_root=export_root, cache_mounts=cache_mounts,
         sync_excludes=list(cfg.sync_excludes),
-        merge_on_conflict=list(cfg.merge_on_conflict))
+        merge_on_conflict=list(cfg.merge_on_conflict),
+        dial_rewrites=dial_rewrites)
     _announce(f"preparing sandbox image {image} (first pull can take a while)")
     backend.ensure_image()
     _announce("sandbox image ready")

{agentic_dev_loop-1.0.0a36 → agentic_dev_loop-1.0.0a38}/src/agentic_dev_loop/engine/stages.py

@@ -58,6 +58,13 @@ DEFAULT_MAX_ITERATIONS = 500
 DEFAULT_COMMAND_TIMEOUT = 600.0  # seconds - a pytest-class suite budget
 LAST_ERROR = "last-error.md"
 ARTIFACT_CONTEXT_CAP = 24_000  # chars per artifact injected into a step's context
+CUSTOM_PROMPT_HEADING = "Run-specific instructions"
+
+
+def custom_prompt_section(text: str) -> str:
+    """The per-step ``custom_prompt`` section (040): appended verbatim, no
+    rewording, under a fixed heading."""
+    return f"## {CUSTOM_PROMPT_HEADING}\n\n{text}"
 
 
 class _TurnPauseController:
@@ -432,15 +439,19 @@ def _artifact_file(runtime: Runtime, step_name: str) -> str | None:
 
 def build_context(runtime: Runtime, docs: dict[str, str], subject: str,
                   notes: list[str] | None = None,
-                  artifacts: dict[str, str] | None = None) -> str:
+                  artifacts: dict[str, str] | None = None,
+                  custom_prompt: str | None = None) -> str:
     """Assemble the attempt's shared message: the always-on agent-facing error
-    guide (034), subject, doc bundle, the canonical dependency-policy paragraph
-    (021), the expected-output-paths section generated from step defs (a prompt
-    merely naming files lets agents skip them), accumulated stage artifacts
-    (027), and previous-attempt notes."""
+    guide (034), subject, doc bundle, the run-specific instructions appended
+    from the step's ``custom_prompt`` (040), the canonical dependency-policy
+    paragraph (021), the expected-output-paths section generated from step
+    defs (a prompt merely naming files lets agents skip them), accumulated
+    stage artifacts (027), and previous-attempt notes."""
     parts = [f"You are working on {subject}.\n", guide_section()]
     for name, content in docs.items():
         parts.append(f"## {name}\n\n{content}")
+    if custom_prompt:
+        parts.append(custom_prompt_section(custom_prompt))
     if artifacts:
         parts.append("## Stage artifacts")
         for step_name, content in artifacts.items():
@@ -613,11 +624,14 @@ def build_brief_context(runtime: Runtime, step: StepConfig,
     """Assemble the brief agent's task message (033): the always-on
     agent-facing error guide (034), the resolved unit/plan docs (re-read from
     disk where sources are known), the closed ``brief_inputs.include`` file
-    set, and the env-facts block. Prior verdicts and feedback are deliberately
+    set, the run-specific instructions appended from ``custom_prompt`` (040),
+    and the env-facts block. Prior verdicts and feedback are deliberately
     absent - the notes channel delivers them per attempt."""
     sections, env_facts = _brief_sections(runtime, step, docs, doc_sources)
     parts = [guide_section()]
     parts += [f"## {name}\n\n{content}" for name, content in sections.items()]
+    if step.custom_prompt:
+        parts.append(custom_prompt_section(step.custom_prompt))
     if env_facts:
         parts.append("## Environment facts\n\n"
                      + "\n".join(f"- {fact}" for fact in env_facts))
@@ -683,7 +697,8 @@ def make_agent_node(runtime: Runtime, step: StepConfig):
         max_iterations = step.max_iterations or DEFAULT_MAX_ITERATIONS
         message = build_context(runtime, state["docs"], state["subject"],
                                 state["notes"],
-                                artifacts=state.get("artifacts", {}))
+                                artifacts=state.get("artifacts", {}),
+                                custom_prompt=step.custom_prompt)
         print(f"[{subject}] Running {step.agent} agent...", flush=True)
         result = runtime.run_agent(step.agent, message,
                                     max_iterations=max_iterations, step=step)

{agentic_dev_loop-1.0.0a36 → agentic_dev_loop-1.0.0a38/src/agentic_dev_loop.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentic-dev-loop
-Version: 1.0.0a36
+Version: 1.0.0a38
 Summary: Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase.
 Author: Luke Wilson
 License-Expression: Apache-2.0
@@ -328,11 +328,13 @@ steps:
   a command like `curl ... -o spec.json` has no writable cwd to write into.
   Declare `mounts: [{ path: ".", mode: rw }]` (or a narrower rw path) for any
   networked step that needs to produce files.
-- **`network: true` is now scoped by the `egress:` allowlist.** A networked
-  step's traffic is forced through an engine-run per-policy egress proxy
-  (injected via `HTTP_PROXY`/`HTTPS_PROXY` and reached through the
-  `host.docker.internal` host-gateway); a request to an undeclared host is
-  denied and logged as an enforcement event. The engine never adds an
+- **`network: true` is scoped by the `egress:` allowlist, and egress is
+  structurally enforced.** A networked step runs on a per-run internal
+  docker network with no route to the host. Its traffic is forced
+  through a containerized egress proxy (injected via
+  `HTTP_PROXY`/`HTTPS_PROXY`, pointed at the proxy container's DNS name
+  on the internal network); a request to an undeclared host is denied
+  and logged as an enforcement event. The engine never adds an
   undeclared target. `egress: { class: browser }` is the explicit
   broad-but-logged class (every connection logged, nothing filtered); command
   and agent steps default to a strict allowlist.
@@ -342,16 +344,16 @@ steps:
   to exactly the declared hosts for that stage; the default stays network-off
   everywhere. Reserve it for stages that need it (QA, integration). The
   residual risks are documented in [docs/setup.md](docs/setup.md).
-- **Host-service reachability (planned - planning-docs/037, 038).** A host
-  service reached at `host.docker.internal` through the proxy fails today:
-  the policy admits it, but the proxy dials from the host, where that
-  container-only name does not resolve (a 502 for the client). 037 rewrites
-  `host.docker.internal` to host loopback at the proxy dial site, so signed
-  host-service traffic (an S3 SDK against a local MinIO, say) reaches the
-  host through the enforced, logged path. 038 then replaces the
-  host-gateway model with a per-run internal network: sandboxes get no host
-  route, and a containerized proxy on a second host-access network is the
-  only egress path.
+- **Host-service reachability (planning-docs/037, 038).** The egress
+  proxy is a container on the run's internal network with a second
+  host-access attachment carrying the `host.docker.internal`
+  host-gateway alias, so the name resolves natively inside the proxy
+  container and host services (an S3 SDK against a local MinIO, say)
+  are reached through the enforced, logged path. Sandbox containers
+  have no host route: the internal network carries no default route to
+  the host, and sandbox containers get no host-gateway alias.
+  `dial_rewrites` on the proxy remains the platform override for hosts
+  where the alias does not resolve.
 
 ### Sync-back conflicts (host edits during a run)