agentic-dev-loop 1.0.0a46__tar.gz → 1.0.0a48__tar.gz

{agentic_dev_loop-1.0.0a46/src/agentic_dev_loop.egg-info → agentic_dev_loop-1.0.0a48}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentic-dev-loop
-Version: 1.0.0a46
+Version: 1.0.0a48
 Summary: Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase.
 Author: Luke Wilson
 License-Expression: Apache-2.0
@@ -384,10 +384,11 @@ steps:
   structurally enforced.** A networked step runs on a per-run internal
   docker network with no route to the host. Its traffic is forced
   through a containerized egress proxy (injected via
-  `HTTP_PROXY`/`HTTPS_PROXY`, pointed at the proxy container's DNS name
-  on the internal network); a request to an undeclared host is denied
-  and logged as an enforcement event. The engine never adds an
-  undeclared target. `egress: { class: browser }` is the explicit
+  `HTTP_PROXY`/`HTTPS_PROXY`, pointed at the proxy's internal IP
+  on the internal network; each distinct egress policy gets its own
+  proxy with a distinct internal IP); a request to an undeclared host
+  is denied and logged as an enforcement event. The engine never adds
+  an undeclared target. `egress: { class: browser }` is the explicit
   broad-but-logged class (every connection logged, nothing filtered); command
   and agent steps default to a strict allowlist.
 - **Command, agent, and sandbox-action steps** may declare it. The host-side

{agentic_dev_loop-1.0.0a46 → agentic_dev_loop-1.0.0a48}/README.md

@@ -340,10 +340,11 @@ steps:
   structurally enforced.** A networked step runs on a per-run internal
   docker network with no route to the host. Its traffic is forced
   through a containerized egress proxy (injected via
-  `HTTP_PROXY`/`HTTPS_PROXY`, pointed at the proxy container's DNS name
-  on the internal network); a request to an undeclared host is denied
-  and logged as an enforcement event. The engine never adds an
-  undeclared target. `egress: { class: browser }` is the explicit
+  `HTTP_PROXY`/`HTTPS_PROXY`, pointed at the proxy's internal IP
+  on the internal network; each distinct egress policy gets its own
+  proxy with a distinct internal IP); a request to an undeclared host
+  is denied and logged as an enforcement event. The engine never adds
+  an undeclared target. `egress: { class: browser }` is the explicit
   broad-but-logged class (every connection logged, nothing filtered); command
   and agent steps default to a strict allowlist.
 - **Command, agent, and sandbox-action steps** may declare it. The host-side

{agentic_dev_loop-1.0.0a46 → agentic_dev_loop-1.0.0a48}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agentic-dev-loop"
-version = "1.0.0a46"
+version = "1.0.0a48"
 description = "Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase."
 readme = "README.md"
 requires-python = ">=3.12"

{agentic_dev_loop-1.0.0a46 → agentic_dev_loop-1.0.0a48}/src/agentic_dev_loop/engine/isolation.py

@@ -31,7 +31,7 @@ import sys
 import time
 import uuid
 from abc import ABC, abstractmethod
-from collections.abc import Mapping
+from collections.abc import Iterable, Mapping
 from dataclasses import dataclass
 from datetime import datetime, timezone
 from pathlib import Path, PurePosixPath
@@ -299,10 +299,10 @@ def proxy_container_name(run_id: str, profile_key: str) -> str:
     return f"{run_id}-proxy-{profile_key}"
 
 
-def proxy_url(proxy_name: str, port: int = EGRESS_PROXY_PORT) -> str:
-    """The sandbox-reachable proxy URL: the proxy container's internal DNS
-    name on the internal network (038, D3). Never 127.0.0.1 or the host-gateway."""
-    return f"http://{proxy_name}:{port}"
+def proxy_url(proxy_host: str, port: int = EGRESS_PROXY_PORT) -> str:
+    """The sandbox-reachable proxy URL: the proxy's internal address on the
+    internal network (038, D3). Never 127.0.0.1 or the host-gateway."""
+    return f"http://{proxy_host}:{port}"
 
 
 def egress_events_path(iso_state_dir: str | Path, run_id: str) -> Path:
@@ -310,8 +310,10 @@ def egress_events_path(iso_state_dir: str | Path, run_id: str) -> Path:
     return Path(iso_state_dir) / f"{EGRESS_EVENTS_PREFIX}-{run_id}.jsonl"
 
 
-def first_usable_ip(subnets: str) -> str | None:
-    """First usable non-gateway IPv4 address from one or more CIDR subnets."""
+def proxy_usable_ips(subnets: str) -> list[str]:
+    """Usable non-gateway IPv4 host addresses from the first viable subnet
+    (048 D1): ``hosts[1:]``, skipping the gateway at ``hosts[0]``. Empty when
+    no subnet offers a non-gateway host."""
     for token in subnets.split():
         try:
             network = ipaddress.ip_network(token, strict=False)
@@ -322,8 +324,8 @@ def first_usable_ip(subnets: str) -> str | None:
         hosts = list(network.hosts())
         if len(hosts) < 2:
             continue
-        return str(hosts[1])
-    return None
+        return [str(host) for host in hosts[1:]]
+    return []
 
 
 
@@ -964,6 +966,7 @@ class DockerBackend(Sandbox):
         self._run_net = run_network_name(self._run_id)
         self._network_created = False
         self._proxy_containers: list[str] = []
+        self._proxy_ips: dict[str, str] = {}
         self._egress_events_path = egress_events_path(self._iso_state_dir,
                                                       self._run_id)
         self._sandbox_venv_dir = sandbox_venv_dir  # 022 relocated venv (opt-in)
@@ -1309,9 +1312,9 @@ class DockerBackend(Sandbox):
         proxy_url_value: str | None = None
         if network and self._export_root is not None:
             proxy_name = proxy_container_name(self._run_id, key[0][:16])
-            self._start_proxy_container(proxy_name, policy,
-                                         self._dial_rewrites)
-            proxy_url_value = proxy_url(proxy_name)
+            proxy_ip = self._start_proxy_container(proxy_name, policy,
+                                                    self._dial_rewrites)
+            proxy_url_value = proxy_url(proxy_ip)
         payload = docker_create_payload(
             run_id=self._run_id, image=self._image, profile=self._profile,
             workspace=self._workspace, network=network,
@@ -1334,7 +1337,7 @@ class DockerBackend(Sandbox):
                                  started=True)
 
     def _start_proxy_container(self, name: str, policy: EgressPolicy,
-                               dial_rewrites: dict[str, str] | None = None) -> None:
+                               dial_rewrites: dict[str, str] | None = None) -> str:
         """Create one containerized proxy (038 D2/D5, 039 D1-D4): host-access
         network at create time with a pinned internal IP, then attach the internal
         network; the proxy binds that address only and is readiness probed from
@@ -1350,7 +1353,7 @@ class DockerBackend(Sandbox):
         policy_json = egress_proxy_module.policy_to_json(policy)
         dial_rewrites = dict(dial_rewrites or {})
         dial_rewrites_json = json.dumps(dial_rewrites, sort_keys=True)
-        bind_host = self._proxy_internal_ip()
+        bind_host = self._proxy_internal_ip(name)
         payload = docker_proxy_payload(
             run_id=self._run_id, image=self._image, name=name,
             policy_json=policy_json, dial_rewrites_json=dial_rewrites_json,
@@ -1379,22 +1382,63 @@ class DockerBackend(Sandbox):
                 f"{bind_host}:{EGRESS_PROXY_PORT} after "
                 f"{PROXY_READY_ATTEMPTS} readiness probes")
         self._proxy_containers.append(name)
-
-    def _proxy_internal_ip(self) -> str:
-        """Return the pinned first-usable IPv4 address on the internal network."""
+        return bind_host
+
+    def _proxy_internal_ip(self, proxy_name: str) -> str:
+        """Return the per-proxy pinned IPv4 address on the internal network
+        (048 D1): inspect the subnet and the addresses containers already hold
+        on it, then allocate the next free host (profile containers join the
+        run network with a daemon auto-assigned IP, so those must be skipped
+        or the later ``network connect --ip`` collides)."""
         inspect = self._runner.run(
             ["docker", "network", "inspect", "-f",
-             "{{range .IPAM.Config}}{{.Subnet}} {{end}}", self._run_net],
+             "{{range .IPAM.Config}}{{.Subnet}} {{end}}|"
+             "{{range .Containers}}{{.IPv4Address}} {{end}}",
+             self._run_net],
             timeout=30)
         if inspect.exit_code != 0:
             raise SandboxError(
                 f"AE-SBX-021: internal network inspect failed: "
                 f"{inspect.stderr.strip() or inspect.stdout.strip()}")
-        ip = first_usable_ip(inspect.stdout)
-        if ip is None:
+        subnets, sep, in_use_part = inspect.stdout.partition("|")
+        in_use = in_use_part.split() if sep else ()
+        return self._allocate_proxy_ip(subnets, proxy_name, in_use)
+
+    def _allocate_proxy_ip(self, subnets: str, proxy_name: str,
+                           in_use: Iterable[str] = ()) -> str:
+        """Allocate one internal IPv4 address per proxy (048 D1/D2). An
+        existing allocation for ``proxy_name`` is reused; otherwise the first
+        free non-gateway host wins (the first proxy keeps ``hosts[1]``).
+        Addresses in ``in_use`` (held by other containers on the network) are
+        skipped alongside the already-allocated proxy IPs. Raises when the
+        subnet has no free host instead of letting the daemon emit a
+        confusing collision error."""
+        existing = self._proxy_ips.get(proxy_name)
+        if existing is not None:
+            return existing
+        hosts = proxy_usable_ips(subnets)
+        if not hosts:
             raise SandboxError(
                 f"AE-SBX-021: internal network has no usable IPv4 subnet: "
-                f"{inspect.stdout.strip()!r}")
+                f"{subnets.strip()!r}")
+        taken = set(self._proxy_ips.values())
+        for token in in_use:
+            addr = token.split("/", 1)[0].strip()
+            try:
+                ip = ipaddress.ip_address(addr)
+            except ValueError:
+                continue
+            if isinstance(ip, ipaddress.IPv4Address):
+                taken.add(str(ip))
+        free = [host for host in hosts if host not in taken]
+        if not free:
+            raise SandboxError(
+                f"AE-SBX-021: internal network {subnets.strip()!r} has "
+                f"{len(hosts)} usable proxy address(es) but "
+                f"{len(self._proxy_ips) + 1} egress proxies were requested - "
+                f"no free address to assign")
+        ip = free[0]
+        self._proxy_ips[proxy_name] = ip
         return ip
 
     def _wait_proxy_ready(self, name: str, host: str) -> bool:
@@ -1541,6 +1585,7 @@ class DockerBackend(Sandbox):
         for name in self._proxy_containers:
             self._rm_container(name)
         self._proxy_containers.clear()
+        self._proxy_ips.clear()
         if self._network_created:
             self._runner.run(["docker", "network", "rm", self._run_net], timeout=60)
             self._network_created = False

{agentic_dev_loop-1.0.0a46 → agentic_dev_loop-1.0.0a48/src/agentic_dev_loop.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentic-dev-loop
-Version: 1.0.0a46
+Version: 1.0.0a48
 Summary: Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase.
 Author: Luke Wilson
 License-Expression: Apache-2.0
@@ -384,10 +384,11 @@ steps:
   structurally enforced.** A networked step runs on a per-run internal
   docker network with no route to the host. Its traffic is forced
   through a containerized egress proxy (injected via
-  `HTTP_PROXY`/`HTTPS_PROXY`, pointed at the proxy container's DNS name
-  on the internal network); a request to an undeclared host is denied
-  and logged as an enforcement event. The engine never adds an
-  undeclared target. `egress: { class: browser }` is the explicit
+  `HTTP_PROXY`/`HTTPS_PROXY`, pointed at the proxy's internal IP
+  on the internal network; each distinct egress policy gets its own
+  proxy with a distinct internal IP); a request to an undeclared host
+  is denied and logged as an enforcement event. The engine never adds
+  an undeclared target. `egress: { class: browser }` is the explicit
   broad-but-logged class (every connection logged, nothing filtered); command
   and agent steps default to a strict allowlist.
 - **Command, agent, and sandbox-action steps** may declare it. The host-side

{agentic_dev_loop-1.0.0a46 → agentic_dev_loop-1.0.0a48}/tests/test_isolation.py

@@ -1581,7 +1581,7 @@ class TestUnit5RuntimeEnforcement:
 
     def test_profile_container_mounts_and_proxy_env(self, tmp_path):
         """038: a step's mount set + egress policy key a pooled container;
-        the proxy env points at the proxy container's internal DNS name
+        the proxy env points at the proxy container's internal IP
         (never 127.0.0.1 or the host-gateway), the proxy binds a pinned
         internal IP after a readiness probe, and the exec cwd is the export
         root."""
@@ -1633,7 +1633,7 @@ class TestUnit5RuntimeEnforcement:
                           if a.startswith("HTTP_PROXY=")
                           or a.startswith("HTTPS_PROXY=")]
             assert proxy_envs and all(
-                f"http://{proxy_name}:3128" in a for a in proxy_envs)
+                "http://172.18.0.2:3128" in a for a in proxy_envs)
             assert run_argv[run_argv.index("--workdir") + 1] == str(export)
             inspect = runner.calls[6]
             assert inspect == ["docker", "inspect", "-f",
@@ -2434,6 +2434,84 @@ class TestNetworkEgressEnforcement:
 
 
 
+class TestProxyIpAllocation:
+    """048: per-proxy internal IP allocation - distinct ``--ip`` per proxy,
+    the first proxy keeps ``hosts[1]``, subnet exhaustion fails fast, and a
+    failed attach surfaces the daemon stderr."""
+
+    def test_two_proxies_get_distinct_ips(self, tmp_path):
+        runner = FakeRunner(
+            ok(""), ok("172.18.0.0/16 "), ok("proxy"), ok(""), ok(""),
+            ok("172.18.0.0/16 "), ok("proxy"), ok(""), ok(""))
+        backend = _backend(tmp_path, runner, network=True)
+        backend._start_proxy_container("r-proxy-aaa", EgressPolicy())
+        backend._start_proxy_container("r-proxy-bbb", EgressPolicy())
+        connects = [c for c in backend._runner.calls if "--ip" in c]
+        assert [c[c.index("--ip") + 1] for c in connects] == \
+            ["172.18.0.2", "172.18.0.3"]
+        runs = [c for c in backend._runner.calls if "--host" in c]
+        assert [c[c.index("--host") + 1] for c in runs] == \
+            ["172.18.0.2", "172.18.0.3"]
+
+    def test_allocation_reused_for_same_name(self, tmp_path):
+        backend = _backend(tmp_path, FakeRunner())
+        first = backend._allocate_proxy_ip("172.18.0.0/16 ", "p1")
+        again = backend._allocate_proxy_ip("172.18.0.0/16 ", "p1")
+        assert first == "172.18.0.2"
+        assert again == first
+
+    def test_exhaustion_raises_naming_subnet_and_count(self, tmp_path):
+        backend = _backend(tmp_path, FakeRunner())
+        backend._allocate_proxy_ip("172.18.0.0/30 ", "p1")
+        with pytest.raises(SandboxError,
+                           match=r"1 usable proxy address.*2 egress proxies"):
+            backend._allocate_proxy_ip("172.18.0.0/30 ", "p2")
+
+    def test_in_use_addresses_are_skipped(self, tmp_path):
+        """048 fix: addresses held by other containers on the network (the
+        profile containers auto-join it) must be skipped, not re-pinned."""
+        backend = _backend(tmp_path, FakeRunner())
+        first = backend._allocate_proxy_ip("172.18.0.0/16 ", "p1")
+        second = backend._allocate_proxy_ip(
+            "172.18.0.0/16 ", "p2", in_use=["172.18.0.3/16"])
+        assert first == "172.18.0.2"
+        assert second == "172.18.0.4"
+
+    def test_in_use_parsing_ignores_malformed_and_ipv6_tokens(self, tmp_path):
+        backend = _backend(tmp_path, FakeRunner())
+        backend._allocate_proxy_ip("172.18.0.0/16 ", "p1")
+        second = backend._allocate_proxy_ip(
+            "172.18.0.0/16 ", "p2",
+            in_use=["172.18.0.2/16", "172.18.0.3/16", "fd00::2/64",
+                    "garbage"])
+        assert second == "172.18.0.4"
+
+    def test_second_proxy_skips_container_held_ips(self, tmp_path):
+        """048 fix: the inspect output reports in-use container addresses;
+        the second proxy skips the first proxy's IP AND the auto-assigned
+        profile-container IP (the CI AE-SBX-020 collision)."""
+        runner = FakeRunner(
+            ok(""), ok("172.18.0.0/16 |"), ok("proxy"), ok(""), ok(""),
+            ok("172.18.0.0/16 |172.18.0.2/16 172.18.0.3/16 "),
+            ok("proxy"), ok(""), ok(""))
+        backend = _backend(tmp_path, runner, network=True)
+        backend._start_proxy_container("r-proxy-aaa", EgressPolicy())
+        backend._start_proxy_container("r-proxy-bbb", EgressPolicy())
+        connects = [c for c in backend._runner.calls if "--ip" in c]
+        assert [c[c.index("--ip") + 1] for c in connects] == \
+            ["172.18.0.2", "172.18.0.4"]
+
+    def test_connect_failure_message_carries_stderr_tail(self, tmp_path):
+        runner = FakeRunner(
+            ok(""), ok("172.18.0.0/16 "), ok("proxy"),
+            fail(1, "Error response from daemon: Address already in use"))
+        backend = _backend(tmp_path, runner, network=True)
+        with pytest.raises(SandboxError,
+                           match="Address already in use") as exc:
+            backend._start_proxy_container("r-proxy-abc", EgressPolicy())
+        assert "AE-SBX-020" in str(exc.value)
+
+
 class TestRegisterBeforeCreate:
     """042 D1: every create site appends its registry record before the
     create command, so a failed create still leaves a stale entry the close()

{agentic_dev_loop-1.0.0a46 → agentic_dev_loop-1.0.0a48}/tests/test_isolation_integration.py

@@ -3,16 +3,18 @@ reason when no daemon or integration image is present; never silently skipped
 in CI (the workflows pre-install Docker and the image)."""
 from __future__ import annotations
 
+import http.server
 import json
 import os
 import shutil
 import subprocess
 import sys
+import threading
 
 import pytest
 
 from agentic_dev_loop.core.config import IsolationConfig, MountSpec
-from agentic_dev_loop.engine.egress_policy import EgressPolicy
+from agentic_dev_loop.engine.egress_policy import EgressPolicy, TargetEntry
 from agentic_dev_loop.engine.isolation import (
     CONTAINER_REGISTRY, DockerBackend, SandboxExecutionRequest, SandboxError,
     SubprocessRunner, probe_docker, process_start, read_stamp,
@@ -409,3 +411,79 @@ class TestReaperE2E:
              "--format", "{{.Names}}"],
             timeout=30)
         assert name not in inspect.stdout
+
+
+
+class TestTwoProxyDistinctIpsE2E:
+    """048: two distinct egress policies on one run network each get their
+    own proxy container (distinct internal IP) and both relay an allowed
+    loopback dial through the host gateway."""
+
+    def _target(self, body):
+        class _Handler(http.server.BaseHTTPRequestHandler):
+            def do_GET(self):
+                payload = body.encode()
+                self.send_response(200)
+                self.send_header("Content-Length", str(len(payload)))
+                self.end_headers()
+                self.wfile.write(payload)
+
+            def log_message(self, *args):
+                pass
+
+        server = http.server.ThreadingHTTPServer(("0.0.0.0", 0), _Handler)
+        threading.Thread(target=server.serve_forever, daemon=True).start()
+        return server
+
+    def _backend_with_export(self, tmp_path):
+        reason = _docker_available()
+        if reason is not None:
+            pytest.skip(reason)
+        ws = tmp_path / "ws"
+        (ws / "src").mkdir(parents=True)
+        (ws / "src" / "a.py").write_text("orig")
+        export = tmp_path / "state" / "exports" / "r1"
+        StepWorkspace.materialise(ws, [], "linux", export)
+        profile = resolve_effective_profile(IsolationConfig(image=TEST_IMAGE))
+        b = DockerBackend(image=TEST_IMAGE, workspace=str(ws),
+                          iso_state_dir=str(tmp_path / "state"), profile=profile,
+                          export_root=str(export))
+        b.ensure_image()
+        b.create_execution_container()
+        return b, export
+
+    def test_two_proxies_attach_and_relay(self, tmp_path):
+        server_a = self._target("hello-from-a")
+        server_b = self._target("hello-from-b")
+        b, export = self._backend_with_export(tmp_path)
+        try:
+            cases = [
+                (EgressPolicy(targets=(TargetEntry(
+                    host="host.docker.internal",
+                    port=server_a.server_address[1]),)),
+                 server_a.server_address[1], "hello-from-a"),
+                (EgressPolicy(targets=(TargetEntry(
+                    host="host.docker.internal",
+                    port=server_b.server_address[1]),)),
+                 server_b.server_address[1], "hello-from-b"),
+            ]
+            ms = resolve_mount_set([MountSpec(path=".", mode="ro")])
+            for policy, port, body in cases:
+                code = (
+                    "import urllib.request;"
+                    f"print(urllib.request.urlopen('http://host.docker.internal:{port}/').read().decode())"
+                )
+                req = SandboxExecutionRequest(
+                    argv=["python", "-c", code],
+                    cwd=str(export),
+                    env={"PATH": "/usr/local/bin:/usr/bin:/bin", "HOME": "/tmp"},
+                    network=True, mount_set=ms, egress_policy=policy)
+                result = b.run(req)
+                assert result.exit_code == 0, result.stderr
+                assert body in result.stdout
+            ips = sorted(b._proxy_ips.values())
+            assert len(ips) == 2 and ips[0] != ips[1]
+        finally:
+            b.close()
+            server_a.shutdown()
+            server_b.shutdown()