agentic-dev-loop 1.0.0a7__tar.gz → 1.0.0a9__tar.gz

{agentic_dev_loop-1.0.0a7 → agentic_dev_loop-1.0.0a9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentic-dev-loop
-Version: 1.0.0a7
+Version: 1.0.0a9
 Summary: Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase.
 Author: Luke Wilson
 License-Expression: Apache-2.0
@@ -27,15 +27,12 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: pydantic>=2.0
 Requires-Dist: PyYAML>=6.0
-Provides-Extra: engine
-Requires-Dist: openhands-sdk~=1.17.0; extra == "engine"
-Requires-Dist: openhands-tools~=1.17.0; extra == "engine"
-Requires-Dist: agent-client-protocol<1.0.0; extra == "engine"
-Requires-Dist: langgraph>=1.2; extra == "engine"
-Requires-Dist: langgraph-checkpoint-sqlite>=3.0; extra == "engine"
-Provides-Extra: workflow
+Requires-Dist: openhands-sdk~=1.17.0
+Requires-Dist: openhands-tools~=1.17.0
+Requires-Dist: agent-client-protocol<1.0.0
+Requires-Dist: langgraph>=1.2
+Requires-Dist: langgraph-checkpoint-sqlite>=3.0
 Provides-Extra: dev
-Requires-Dist: agentic-dev-loop[engine]; extra == "dev"
 Requires-Dist: hypothesis>=6.0; extra == "dev"
 Requires-Dist: pytest>=8.0; extra == "dev"
 Dynamic: license-file
@@ -65,11 +62,6 @@ flowchart LR
 - **Sandboxed by default.** The agent's shell and every command step run inside
   an always-on Docker sandbox. There is no opt-out.
 
-Two modes share one `pipeline.yaml`: **engine mode** (the sandboxed, resumable
-loop above) and **workflow mode** — a Claude Dynamic Workflow exported from the
-same pipeline that runs in Claude Code's own environment, with the live graph
-visualiser. See [Workflow mode](#workflow-mode-claude-code).
-
 ---
 
 ## Core features
@@ -98,13 +90,8 @@ LLM timeout (agent runs are long).
 | LLM API key | The env var named by your pipeline's `api_key_env` (e.g. `OPENAI_API_KEY`) must be set — a missing key fails fast, naming it. |
 
 ```bash
-# engine mode (sandboxed loop — the full install)
-pip install "agentic-dev-loop[engine]==1.0.0a6"
+pip install "agentic-dev-loop==1.0.0a8"
 agentic-dev-loop --version
-
-# workflow mode (Claude Code — core + viz only, no SDK/Docker deps)
-pip install "agentic-dev-loop==1.0.0a6"
-agentic-dev-loop-workflow install-skill
 ```
 
 On the first run the engine pulls the **digest-pinned** dev image
@@ -115,43 +102,6 @@ image. Engine setup, first-run details, the full `pipeline.yaml` contract, and
 troubleshooting for every fail-fast code live in
 [docs/setup.md](docs/setup.md).
 
-## Workflow mode (Claude Code)
-
-For developers who know and love the agentic dev loop but are forced to use
-Claude Code at work: workflow mode exports a **Claude Dynamic Workflow** from
-the `pipeline.yaml` they already trust, plus the visualiser they trust. It adds
-the deterministic loop through Claude's mechanism — nothing more. **No Docker
-sandboxing, and no new security claims**: workflow steps run in Claude Code's
-own environment under its permission model (a documented trust-model change
-from engine mode).
-
-Install the skill once:
-
-```bash
-pip install "agentic-dev-loop==1.0.0a6"  # base install: core + viz, no SDK/Docker
-agentic-dev-loop-workflow install-skill # → ~/.claude/skills/agentic-dev-loop/
-```
-
-Then invoke `/agentic-dev-loop` in Claude Code. The skill walks through:
-
-1. **Build** — `python -m agentic_dev_loop.core.project <pipeline.yaml>` loads +
-   validates the pipeline, verifies every agent step's `.agent.md` prompt exists
-   (a missing prompt fails the build loudly, naming the file), and writes a
-   self-contained `.agentic-dev-loop/workflow.js`. Steps are frozen at creation
-   — mid-run `pipeline.yaml` edits never affect a running workflow.
-2. **Run** — the generated JS routes `on_pass` / `on_fail` / `goto` with its own
-   attempt counter, injects the failing subagent's output as the next retry note,
-   launches the live-graph server (localhost, token-authenticated ingest), and
-   invokes the docker-free commit shim, which refuses loudly unless the worktree
-   was clean at run start.
-
-Engine-only fields (`isolation:`, per-step `network:`, `setup:`) are ignored in
-workflow mode with no effect on the build or run.
-
-The base install is deliberately dependency-light (`pydantic` + `PyYAML` only);
-the heavy OpenHands-SDK engine lives in the `[engine]` extra. The `core` and
-`viz` packages are guarded against pulling engine deps.
-
 ## Usage
 
 ```bash
@@ -242,9 +192,49 @@ steps:
 | `produces:` / `artifact:` + `verdicts:` | Hygiene-tracked outputs vs verdict-parsed routing. The **last** `VERDICT:` line wins; stale artifacts are deleted at each attempt start. |
 | `on_pass:` / `on_fail:` | A step name, terminal `success`/`failure`, or `{goto: X, retry: true}`. No loops happen unless you write them. |
 | `env:` / `setup:` / `network:` | `env:` declares step vars (fixed safe base + declared vars only); `setup:` provisions the sandbox (command steps, network ON, stamp-cached); `network: true` grants egress to a command or agent step (default off) — see [Per-stage networking](#per-stage-networking). |
+| `secrets:` (top-level) / step `secrets:` | Declares secret **refs only — never values**; each step opts in to the refs it needs. Resolved host-side and injected into that step's exec env only. See [Secrets](#secrets--refs-only-never-values). |
 | `isolation:` (optional) | Configures the sandbox — image override, resource caps, `allow_git_mutations`. It can never disable it. |
 | `state_dir` | Defaults to `~/.agentic-dev-loop/runs/<pipeline-hash>/` — artifacts and checkpoints live outside the sandbox mount. |
 
+### Secrets (`secrets:`) — refs only, never values
+
+Secret values never belong in the pipeline yaml, the workspace, or `state_dir`.
+Declare the refs at the top level and opt each step into the refs it needs:
+
+```yaml
+secrets:                              # refs only — never values
+  kinde-client-secret:                # ref name (arbitrary)
+    from: env                         # provider name
+    key: KINDIE_CLIENT_SECRET         # provider-specific locator
+  r2-keys:
+    from: env
+    key: YOSK_R2_KEYS
+
+steps:
+  - name: qa
+    agent: qa
+    secrets: [kinde-client-secret, r2-keys]
+```
+
+- The engine resolves every declared ref **host-side at run start** (the `env`
+  provider reads the named host environment variable). A missing variable, an
+  unknown provider, or a ref a step lists without declaring it fails fast —
+  naming the ref, the step, and the provider error. No silent fallback.
+- A resolved secret is injected into a step's exec env **only when that step
+  lists the ref** — the same path step `env:` uses, no new channel. The secret
+  never reaches the provision container, `state_dir`, or any other step.
+- Prefer a mechanical `command` step for secret-consuming work (a script runs
+  the app with creds) so the LLM and the secret never meet; an `agent` step
+  holds a secret only when its job genuinely requires it.
+- **`.env*` ban.** At run start the workspace root is scanned for `.env*`
+  files. Any hit fails fast, naming the files, with the remedy text. The
+  convention fixtures `.env.example`, `.env.template`, and `.env.sample` are
+  whitelisted. This applies regardless of `network:` flags.
+- **Output scrubbing.** Resolved secret values are scrubbed from every
+  engine-written output — captured step output, retry notes, artifacts, and
+  `state_dir` files. (Hygiene: the declaring step's agent has already seen
+  the value in its own env.)
+
 ### Per-stage networking
 
 The sandbox is network-off by default. A step that legitimately needs egress —
@@ -276,8 +266,7 @@ steps:
 git clone git@github.com:lukedawilson/agentic-dev-loop.git
 cd agentic-dev-loop
 ./setup-venv.sh                       # idempotent .venv setup (never touches bare pip)
-# create .env with your LLM key (loaded by trigger-agentic-dev-loop.sh, never committed):
-#   echo 'OPENAI_API_KEY=...' > .env
+export OPENAI_API_KEY=...           # set your LLM key in the host env (no .env in the repo)
 python -m pytest tests/ -q            # fast suite
 python -m pytest tests/ -q -m "not docker"   # skip engine-dependent tests
 ./trigger-agentic-dev-loop.sh --dry-run      # run the shipped pipeline against this repo

{agentic_dev_loop-1.0.0a7 → agentic_dev_loop-1.0.0a9}/README.md

@@ -23,11 +23,6 @@ flowchart LR
 - **Sandboxed by default.** The agent's shell and every command step run inside
   an always-on Docker sandbox. There is no opt-out.
 
-Two modes share one `pipeline.yaml`: **engine mode** (the sandboxed, resumable
-loop above) and **workflow mode** — a Claude Dynamic Workflow exported from the
-same pipeline that runs in Claude Code's own environment, with the live graph
-visualiser. See [Workflow mode](#workflow-mode-claude-code).
-
 ---
 
 ## Core features
@@ -56,13 +51,8 @@ LLM timeout (agent runs are long).
 | LLM API key | The env var named by your pipeline's `api_key_env` (e.g. `OPENAI_API_KEY`) must be set — a missing key fails fast, naming it. |
 
 ```bash
-# engine mode (sandboxed loop — the full install)
-pip install "agentic-dev-loop[engine]==1.0.0a6"
+pip install "agentic-dev-loop==1.0.0a8"
 agentic-dev-loop --version
-
-# workflow mode (Claude Code — core + viz only, no SDK/Docker deps)
-pip install "agentic-dev-loop==1.0.0a6"
-agentic-dev-loop-workflow install-skill
 ```
 
 On the first run the engine pulls the **digest-pinned** dev image
@@ -73,43 +63,6 @@ image. Engine setup, first-run details, the full `pipeline.yaml` contract, and
 troubleshooting for every fail-fast code live in
 [docs/setup.md](docs/setup.md).
 
-## Workflow mode (Claude Code)
-
-For developers who know and love the agentic dev loop but are forced to use
-Claude Code at work: workflow mode exports a **Claude Dynamic Workflow** from
-the `pipeline.yaml` they already trust, plus the visualiser they trust. It adds
-the deterministic loop through Claude's mechanism — nothing more. **No Docker
-sandboxing, and no new security claims**: workflow steps run in Claude Code's
-own environment under its permission model (a documented trust-model change
-from engine mode).
-
-Install the skill once:
-
-```bash
-pip install "agentic-dev-loop==1.0.0a6"  # base install: core + viz, no SDK/Docker
-agentic-dev-loop-workflow install-skill # → ~/.claude/skills/agentic-dev-loop/
-```
-
-Then invoke `/agentic-dev-loop` in Claude Code. The skill walks through:
-
-1. **Build** — `python -m agentic_dev_loop.core.project <pipeline.yaml>` loads +
-   validates the pipeline, verifies every agent step's `.agent.md` prompt exists
-   (a missing prompt fails the build loudly, naming the file), and writes a
-   self-contained `.agentic-dev-loop/workflow.js`. Steps are frozen at creation
-   — mid-run `pipeline.yaml` edits never affect a running workflow.
-2. **Run** — the generated JS routes `on_pass` / `on_fail` / `goto` with its own
-   attempt counter, injects the failing subagent's output as the next retry note,
-   launches the live-graph server (localhost, token-authenticated ingest), and
-   invokes the docker-free commit shim, which refuses loudly unless the worktree
-   was clean at run start.
-
-Engine-only fields (`isolation:`, per-step `network:`, `setup:`) are ignored in
-workflow mode with no effect on the build or run.
-
-The base install is deliberately dependency-light (`pydantic` + `PyYAML` only);
-the heavy OpenHands-SDK engine lives in the `[engine]` extra. The `core` and
-`viz` packages are guarded against pulling engine deps.
-
 ## Usage
 
 ```bash
@@ -200,9 +153,49 @@ steps:
 | `produces:` / `artifact:` + `verdicts:` | Hygiene-tracked outputs vs verdict-parsed routing. The **last** `VERDICT:` line wins; stale artifacts are deleted at each attempt start. |
 | `on_pass:` / `on_fail:` | A step name, terminal `success`/`failure`, or `{goto: X, retry: true}`. No loops happen unless you write them. |
 | `env:` / `setup:` / `network:` | `env:` declares step vars (fixed safe base + declared vars only); `setup:` provisions the sandbox (command steps, network ON, stamp-cached); `network: true` grants egress to a command or agent step (default off) — see [Per-stage networking](#per-stage-networking). |
+| `secrets:` (top-level) / step `secrets:` | Declares secret **refs only — never values**; each step opts in to the refs it needs. Resolved host-side and injected into that step's exec env only. See [Secrets](#secrets--refs-only-never-values). |
 | `isolation:` (optional) | Configures the sandbox — image override, resource caps, `allow_git_mutations`. It can never disable it. |
 | `state_dir` | Defaults to `~/.agentic-dev-loop/runs/<pipeline-hash>/` — artifacts and checkpoints live outside the sandbox mount. |
 
+### Secrets (`secrets:`) — refs only, never values
+
+Secret values never belong in the pipeline yaml, the workspace, or `state_dir`.
+Declare the refs at the top level and opt each step into the refs it needs:
+
+```yaml
+secrets:                              # refs only — never values
+  kinde-client-secret:                # ref name (arbitrary)
+    from: env                         # provider name
+    key: KINDIE_CLIENT_SECRET         # provider-specific locator
+  r2-keys:
+    from: env
+    key: YOSK_R2_KEYS
+
+steps:
+  - name: qa
+    agent: qa
+    secrets: [kinde-client-secret, r2-keys]
+```
+
+- The engine resolves every declared ref **host-side at run start** (the `env`
+  provider reads the named host environment variable). A missing variable, an
+  unknown provider, or a ref a step lists without declaring it fails fast —
+  naming the ref, the step, and the provider error. No silent fallback.
+- A resolved secret is injected into a step's exec env **only when that step
+  lists the ref** — the same path step `env:` uses, no new channel. The secret
+  never reaches the provision container, `state_dir`, or any other step.
+- Prefer a mechanical `command` step for secret-consuming work (a script runs
+  the app with creds) so the LLM and the secret never meet; an `agent` step
+  holds a secret only when its job genuinely requires it.
+- **`.env*` ban.** At run start the workspace root is scanned for `.env*`
+  files. Any hit fails fast, naming the files, with the remedy text. The
+  convention fixtures `.env.example`, `.env.template`, and `.env.sample` are
+  whitelisted. This applies regardless of `network:` flags.
+- **Output scrubbing.** Resolved secret values are scrubbed from every
+  engine-written output — captured step output, retry notes, artifacts, and
+  `state_dir` files. (Hygiene: the declaring step's agent has already seen
+  the value in its own env.)
+
 ### Per-stage networking
 
 The sandbox is network-off by default. A step that legitimately needs egress —
@@ -234,8 +227,7 @@ steps:
 git clone git@github.com:lukedawilson/agentic-dev-loop.git
 cd agentic-dev-loop
 ./setup-venv.sh                       # idempotent .venv setup (never touches bare pip)
-# create .env with your LLM key (loaded by trigger-agentic-dev-loop.sh, never committed):
-#   echo 'OPENAI_API_KEY=...' > .env
+export OPENAI_API_KEY=...           # set your LLM key in the host env (no .env in the repo)
 python -m pytest tests/ -q            # fast suite
 python -m pytest tests/ -q -m "not docker"   # skip engine-dependent tests
 ./trigger-agentic-dev-loop.sh --dry-run      # run the shipped pipeline against this repo

{agentic_dev_loop-1.0.0a7 → agentic_dev_loop-1.0.0a9}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agentic-dev-loop"
-version = "1.0.0a7"
+version = "1.0.0a9"
 description = "Turn an LLM into a gated, sandboxed, resumable construction loop over your codebase."
 readme = "README.md"
 requires-python = ">=3.12"
@@ -32,23 +32,8 @@ classifiers = [
     "Typing :: Typed",
 ]
 dependencies = [
-    # Base install = workflow mode (core + viz + workflow CLI). Deliberately
-    # dependency-light (TS-1 / NFR-4.1 / BR-2): pydantic + PyYAML only. The
-    # heavy OpenHands-SDK engine deps live in the [engine] extra below.
     "pydantic>=2.0",
     "PyYAML>=6.0",
-]
-
-[project.urls]
-Homepage = "https://github.com/lukedawilson/agentic-dev-loop"
-
-[project.scripts]
-agentic-dev-loop = "agentic_dev_loop.engine.cli:main"
-agentic-dev-loop-workflow = "agentic_dev_loop.workflow.cli:main"
-agentic-dev-loop-commit = "agentic_dev_loop.engine.commit_shim:main"
-
-[project.optional-dependencies]
-engine = [
     "openhands-sdk ~=1.17.0",
     "openhands-tools ~=1.17.0",
     # openhands-sdk declares agent-client-protocol>=0.8.1 with NO upper bound;
@@ -59,12 +44,15 @@ engine = [
     "langgraph>=1.2",
     "langgraph-checkpoint-sqlite>=3.0",
 ]
-# Workflow mode is the BASE install — this empty extra exists only so
-# `pip install agentic-dev-loop[workflow]` reads naturally and pulls nothing
-# beyond the light base (core + viz). See README / NFR-4.1.
-workflow = []
+
+[project.urls]
+Homepage = "https://github.com/lukedawilson/agentic-dev-loop"
+
+[project.scripts]
+agentic-dev-loop = "agentic_dev_loop.engine.cli:main"
+
+[project.optional-dependencies]
 dev = [
-    "agentic-dev-loop[engine]",
     "hypothesis>=6.0",
     "pytest>=8.0",
 ]
@@ -74,7 +62,6 @@ where = ["src"]
 
 [tool.setuptools.package-data]
 agentic_dev_loop = ["py.typed"]
-"agentic_dev_loop.core" = ["workflow.js.template"]
 
 [tool.pytest.ini_options]
 markers = [

{agentic_dev_loop-1.0.0a7 → agentic_dev_loop-1.0.0a9}/src/agentic_dev_loop/core/__init__.py

@@ -1,4 +1,4 @@
-"""Pipeline model + parse + workflow projection (unit-4 core).
+"""Pipeline model + parse + results (core).
 
 Dependency-light by contract (BR-2): pydantic + PyYAML + stdlib only. A guard
 test fails if this package imports engine/viz or heavy deps.
@@ -9,17 +9,10 @@ from .config import (PipelineConfig, StepConfig, LlmConfig, IsolationConfig,
                      default_state_dir, TERMINALS)
 from .results import Result
 from .verdict import Verdict, VerdictError, parse_verdict, RETRY
-from .projection import (ProjectedStep, WorkflowProjection, project_workflow,
-                         validate_prompt_refs, render_workflow_js,
-                         clean_at_start_flag, pipeline_hash, core_version,
-                         WORKFLOW_TEMPLATE)
 
 __all__ = [
     "PipelineConfig", "StepConfig", "LlmConfig", "IsolationConfig",
     "VerdictSpec", "Route", "route_target", "load_config",
     "default_state_dir", "TERMINALS",
     "Result", "Verdict", "VerdictError", "parse_verdict", "RETRY",
-    "ProjectedStep", "WorkflowProjection", "project_workflow",
-    "validate_prompt_refs", "render_workflow_js", "clean_at_start_flag",
-    "pipeline_hash", "core_version", "WORKFLOW_TEMPLATE",
 ]

{agentic_dev_loop-1.0.0a7 → agentic_dev_loop-1.0.0a9}/src/agentic_dev_loop/core/config.py

@@ -11,6 +11,7 @@ import yaml
 from pydantic import BaseModel, ConfigDict, Field, field_validator, model_validator
 
 TERMINALS = frozenset({"success", "failure"})
+KNOWN_SECRET_PROVIDERS = frozenset({"env"})
 
 
 class VerdictSpec(BaseModel):
@@ -36,6 +37,34 @@ def route_target(route: RouteTarget | None) -> str | None:
     return route.goto if isinstance(route, Route) else route
 
 
+class SecretSpec(BaseModel):
+    """One ``secrets:`` ref — the locator only, never a value. ``from`` names
+    the provider (``env`` first); ``key`` is that provider's locator (for
+    ``env``, the host environment variable to read and the step env name to
+    inject). Unknown keys fail at load (extra="forbid")."""
+
+    model_config = ConfigDict(extra="forbid", populate_by_name=True)
+
+    from_: str = Field(alias="from")
+    key: str
+
+    @field_validator("from_")
+    @classmethod
+    def _known_provider(cls, v: str) -> str:
+        if v not in KNOWN_SECRET_PROVIDERS:
+            raise ValueError(
+                f"unknown secret provider {v!r} (known: "
+                f"{sorted(KNOWN_SECRET_PROVIDERS)})")
+        return v
+
+    @field_validator("key")
+    @classmethod
+    def _nonempty_key(cls, v: str) -> str:
+        if not v.strip():
+            raise ValueError("secret key must be a non-empty string")
+        return v
+
+
 class IsolationConfig(BaseModel):
     """Optional `isolation:` section — configures the always-on sandbox (BR-2).
     Absence means opinionated defaults, never unsandboxed behaviour. Unknown
@@ -86,6 +115,7 @@ class StepConfig(BaseModel):
     env: dict[str, str | None] | None = None  # NFR-1: null = inherit host value
     setup: str | None = None  # BR-13: command steps only
     network: bool = False  # per-stage egress (command + agent steps; action steps reject)
+    secrets: list[str] = []  # declared ref names; action steps reject
     on_pass: RouteTarget | None = None
     on_fail: RouteTarget | None = None
 
@@ -148,6 +178,11 @@ class StepConfig(BaseModel):
                 f"step {self.name!r}: 'network' is only allowed on 'agent' or "
                 "'command' steps"
             )
+        if self.secrets and self.action is not None:
+            raise ValueError(
+                f"step {self.name!r}: 'secrets' is only allowed on 'agent' or "
+                "'command' steps"
+            )
         return self
 
 
@@ -170,10 +205,28 @@ class PipelineConfig(BaseModel):
     llm: LlmConfig
     isolation: IsolationConfig | None = None  # None = always-on defaults
     state_dir: str = ".pr"  # default relocated to ~/.agentic-dev-loop/runs/<hash>/ at load
+    secrets: dict[str, SecretSpec] = {}  # ref name -> locator; values never appear here
     max_attempts: int = 3
     agents_dir: str
     steps: list[StepConfig] = Field(min_length=1)
 
+    @field_validator("secrets", mode="before")
+    @classmethod
+    def _reject_value_shaped_refs(cls, v: Any) -> Any:
+        if v is None:
+            return {}
+        if not isinstance(v, dict):
+            raise ValueError(
+                "'secrets' must be a mapping of ref name to "
+                "{from: ..., key: ...}")
+        for name, spec in v.items():
+            if not isinstance(spec, dict):
+                raise ValueError(
+                    f"secret ref {name!r} must be a mapping "
+                    "{from: ..., key: ...}, not a literal value — secret "
+                    "values never belong in the pipeline yaml")
+        return v
+
     @model_validator(mode="after")
     def _check_graph(self) -> "PipelineConfig":
         names = [s.name for s in self.steps]
@@ -191,6 +244,12 @@ class PipelineConfig(BaseModel):
                     raise ValueError(
                         f"step {step.name!r}: unknown route target {target!r}"
                     )
+        for step in self.steps:
+            for ref in step.secrets:
+                if ref not in self.secrets:
+                    raise ValueError(
+                        f"step {step.name!r}: secret ref {ref!r} is not "
+                        "declared in the top-level 'secrets:' section")
         return self
 
 

{agentic_dev_loop-1.0.0a7 → agentic_dev_loop-1.0.0a9}/src/agentic_dev_loop/core/verdict.py

@@ -2,7 +2,7 @@
 
 `Verdict.from_text` parses the captured response for routing; expected
 conditions are typed `Result` errors, never exceptions. `parse_verdict`
-collapses that `Result` to a route string for workflow consumers: a clear
+collapses that `Result` to a route string for routing consumers: a clear
 decision maps to its canonical value, anything unclear maps to ``retry`` —
 totality for arbitrary input (no crash, no silent routing).
 """

{agentic_dev_loop-1.0.0a7 → agentic_dev_loop-1.0.0a9}/src/agentic_dev_loop/engine/__init__.py

@@ -1,2 +1,2 @@
 """Engine package — graph/stages/sandbox/CLI and the heavy OpenHands-SDK
-dependencies (unit-4 re-homing, FR-4.1)."""
+dependencies."""

{agentic_dev_loop-1.0.0a7 → agentic_dev_loop-1.0.0a9}/src/agentic_dev_loop/engine/agents.py

@@ -110,13 +110,17 @@ class SandboxTerminalExecutor(ToolExecutor):
 def register_sandbox_terminal(sandbox: "Sandbox", *, env: dict[str, str | None] | None = None,
                               workspace: str = "", pipeline: str | None = None,
                               step: str | None = None,
-                              network: bool = False) -> None:
+                              network: bool = False,
+                              secrets: dict[str, str] | None = None) -> None:
     """Per-run re-registration of the `terminal` name (KD-4): a callable
     factory that builds the SDK terminal with a `SandboxTerminalExecutor`.
-    Pipelines are sequential, so re-registering per agent step is safe."""
+    Pipelines are sequential, so re-registering per agent step is safe.
+
+    ``secrets`` (019) is the per-step resolved secret env, injected into the
+    terminal's exec env only for steps that declared the refs."""
     from openhands.sdk.tool import register_tool
 
-    resolved_env = resolve_sandbox_env(env)
+    resolved_env = resolve_sandbox_env(env, secrets=secrets)
 
     def factory(conv_state, **params):
         return TerminalTool.create(

{agentic_dev_loop-1.0.0a7 → agentic_dev_loop-1.0.0a9}/src/agentic_dev_loop/engine/dryrun.py

@@ -17,6 +17,7 @@ from .loaders import resolve_docs
 from .isolation import (isolation_state_dir, resolve_effective_profile,
                         resolve_image_ref)
 from .registry import Registry, default_registry, load_extensions
+from .secrets import scan_env_files
 
 
 def _validate_agents(cfg: PipelineConfig, agents_dir: Path) -> None:
@@ -113,6 +114,7 @@ def dry_run(cfg_path, args, registry: Registry | None = None) -> int:
     cfg_path = Path(cfg_path)
     cfg = load_config(cfg_path)
     base = cfg_path.resolve().parent
+    scan_env_files(Path.cwd())
 
     if registry is None:
         registry = default_registry()

{agentic_dev_loop-1.0.0a7 → agentic_dev_loop-1.0.0a9}/src/agentic_dev_loop/engine/graph.py

@@ -22,6 +22,7 @@ from agentic_dev_loop.core.config import load_config
 from .isolation import startup_sandbox
 from .llm import build_llm
 from .loaders import resolve_docs
+from .secrets import resolve_secrets, scan_env_files
 from .registry import Registry, default_registry, load_extensions
 from .stages import (Runtime, build_context, clear_attempt_artifacts,
                      make_action_node, make_agent_node, make_bump_node,
@@ -107,6 +108,11 @@ def run_pipeline(cfg_path, args, *, viz_bus=None,
     base = cfg_path.resolve().parent
     max_attempts = getattr(args, "max_attempts", None) or cfg.max_attempts
 
+    # 019: refuse secret-bearing workspace files and resolve declared secret
+    # refs host-side BEFORE any sandbox/LLM work — fail fast, loudly.
+    scan_env_files(Path.cwd())
+    resolved_secrets = resolve_secrets(cfg)
+
     if registry is None:
         registry = default_registry()
         load_extensions(cfg.extensions, registry)
@@ -122,16 +128,17 @@ def run_pipeline(cfg_path, args, *, viz_bus=None,
                                refresh=getattr(args, "refresh", False))
     try:
         return _run_pipeline(cfg, base, registry, state_dir, max_attempts,
-                             args, viz_bus, sandbox)
+                             args, viz_bus, sandbox, resolved_secrets)
     finally:
         sandbox.close()
 
 
 def _run_pipeline(cfg, base, registry, state_dir, max_attempts, args, viz_bus,
-                  sandbox) -> tuple[bool, int]:
+                  sandbox, resolved_secrets) -> tuple[bool, int]:
     runtime = Runtime(cfg=cfg, registry=registry, llm=build_llm(cfg.llm),
                       agents_dir=base / cfg.agents_dir, state_dir=state_dir,
-                      workspace=Path.cwd(), sandbox=sandbox)
+                      workspace=Path.cwd(), sandbox=sandbox,
+                      secrets=resolved_secrets)
     state_dir.mkdir(parents=True, exist_ok=True)
 
     resume = getattr(args, "resume", None)

{agentic_dev_loop-1.0.0a7 → agentic_dev_loop-1.0.0a9}/src/agentic_dev_loop/engine/isolation.py

@@ -183,11 +183,17 @@ def resolve_effective_profile(isolation: IsolationConfig | None) -> EffectivePro
 
 
 def resolve_sandbox_env(step_env: dict[str, str | None] | None, *,
-                        host_env: Mapping[str, str] | None = None) -> dict[str, str]:
+                        host_env: Mapping[str, str] | None = None,
+                        secrets: Mapping[str, str] | None = None) -> dict[str, str]:
     """Fixed safe base (PATH/HOME/LANG/LC_ALL/TERM) + the step's declared
     ``env:`` mapping only. A declared value of ``None`` inherits the host
     value; the global ``env_allowlist`` is never consulted and the LLM key is
-    never auto-added (NFR-3.1 / BR-9)."""
+    never auto-added (NFR-3.1 / BR-9).
+
+    ``secrets`` (019) carries the per-step resolved secret env — injected last,
+    so a declared ref is authoritative over any same-named ``env:`` entry. It
+    arrives only from ``step_secret_env``, which maps only the refs the step
+    declared, so no secret ever reaches an undeclaring step."""
     source = os.environ if host_env is None else host_env
     env = dict(SANDBOX_ENV_BASE)
     for name, value in (step_env or {}).items():
@@ -196,6 +202,8 @@ def resolve_sandbox_env(step_env: dict[str, str | None] | None, *,
                 env[name] = source[name]
         else:
             env[name] = value
+    for name, value in (secrets or {}).items():
+        env[name] = value
     return env
 
 

{agentic_dev_loop-1.0.0a7 → agentic_dev_loop-1.0.0a9}/src/agentic_dev_loop/engine/outputs.py

@@ -2,9 +2,9 @@
 channel (unit-1).
 
 The pipeline — not the agent — writes the step's artifact from the agent's
-final SDK response. Verdict parsing lives in `core.verdict` (shared with
-workflow mode); this module only owns the SDK-side capture. Expected
-conditions are typed `Result` errors, never exceptions.
+final SDK response. Verdict parsing lives in `core.verdict`; this module only
+owns the SDK-side capture. Expected conditions are typed `Result` errors,
+never exceptions.
 """
 
 from __future__ import annotations
@@ -16,6 +16,7 @@ from pathlib import Path
 from openhands.sdk.conversation.response_utils import get_agent_final_response
 
 from agentic_dev_loop.core.results import Result
+from .secrets import redact_values
 
 
 class CaptureError(enum.Enum):
@@ -32,11 +33,13 @@ class CapturedOutput:
 
     @staticmethod
     def from_agent_result(
-        conv, artifact: str, state_dir: Path
+        conv, artifact: str, state_dir: Path,
+        redactions: tuple[str, ...] = ()
     ) -> "Result[CapturedOutput, CaptureError]":
         text = _final_agent_text(conv)
         if not text.strip():
             return Result.err(CaptureError.EMPTY_RESPONSE)
+        text = redact_values(text, redactions)
         return Result.ok(CapturedOutput(raw_text=text, artifact_path=state_dir / artifact))
 
     def write(self) -> Result[None, CaptureError]: