devflow-engine 1.2.2__py3-none-any.whl → 1.2.4__py3-none-any.whl

devflow_engine/errors/error_solver_dag.py

@@ -244,7 +244,49 @@ def _validate_ui_fix_proof(
     return True, normalized, None
 
 
-def _validate_ui_observability_repro(observation: dict[str, Any]) -> tuple[bool, str | None]:
+def _artifact_under_observability_sandbox(artifact: str, *, error_task_id: str) -> bool:
+    normalized = artifact.replace("\\", "/").strip()
+    allowed_prefixes = (
+        f".devflow/observability/{error_task_id}/",
+        ".devflow/observability/<id>/",
+    )
+    if any(normalized.startswith(prefix) for prefix in allowed_prefixes):
+        return True
+    marker = f"/.devflow/observability/{error_task_id}/"
+    return marker in normalized
+
+
+def _command_targets_observability_sandbox(command: str, *, error_task_id: str) -> bool:
+    normalized = command.replace("\\", "/").strip()
+    allowed_fragments = (
+        f".devflow/observability/{error_task_id}/",
+        ".devflow/observability/<id>/",
+        f"/.devflow/observability/{error_task_id}/",
+    )
+    return any(fragment in normalized for fragment in allowed_fragments)
+
+
+def _repro_tests_under_observability_sandbox(
+    repro_tests: object,
+    *,
+    error_task_id: str,
+) -> bool:
+    if not isinstance(repro_tests, list):
+        return True
+    for test in repro_tests:
+        if not isinstance(test, dict):
+            continue
+        path = str(test.get("file") or test.get("path") or "").strip()
+        if path and not _artifact_under_observability_sandbox(path, error_task_id=error_task_id):
+            return False
+    return True
+
+
+def _validate_ui_observability_repro(
+    observation: dict[str, Any],
+    *,
+    error_task_id: str,
+) -> tuple[bool, str | None]:
     artifact = str(observation.get("repro_artifact_path") or "").strip()
     command = str(observation.get("repro_run_command") or "").strip()
     output = str(observation.get("repro_output") or "").strip()
@@ -256,6 +298,15 @@ def _validate_ui_observability_repro(observation: dict[str, Any]) -> tuple[bool,
         return False, "ui_observability_missing_playwright_repro_artifact"
     if "playwright" not in command.lower():
         return False, "ui_observability_requires_playwright_repro_command"
+    if not _artifact_under_observability_sandbox(artifact, error_task_id=error_task_id):
+        return False, "ui_observability_repro_artifact_outside_sandbox"
+    if not _command_targets_observability_sandbox(command, error_task_id=error_task_id):
+        return False, "ui_observability_repro_command_outside_sandbox"
+    if not _repro_tests_under_observability_sandbox(
+        observation.get("repro_tests"),
+        error_task_id=error_task_id,
+    ):
+        return False, "ui_observability_repro_test_outside_sandbox"
     if not output:
         return False, "ui_observability_missing_repro_output"
     if not isinstance(oracles, list) or not any(str(o or "").strip() for o in oracles):
@@ -876,7 +927,10 @@ class BuildObservabilityNode(Node):
                     else {}
                 )
                 if observed_flag and _ui_proof_required({"runtimeContext": user_report_context_for_ui}):
-                    ui_repro_ok, ui_repro_failure_reason = _validate_ui_observability_repro(observation)
+                    ui_repro_ok, ui_repro_failure_reason = _validate_ui_observability_repro(
+                        observation,
+                        error_task_id=error_task_id,
+                    )
 
                 # Split deferred questions via LLM classifier (v1.1.22).
                 # An injectable hook is used when present so tests can

{devflow_engine-1.2.2.dist-info → devflow_engine-1.2.4.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devflow-engine
-Version: 1.2.2
+Version: 1.2.4
 Summary: DevFlow v2 CLI-first engine (projects, stories, execution store, review packets)
 Author: DevFlow
 License: Proprietary

{devflow_engine-1.2.2.dist-info → devflow_engine-1.2.4.dist-info}/RECORD

@@ -32,7 +32,7 @@ devflow_engine/devin2/agent_definition.py,sha256=pCp915tojwPlepRpvjlU1DoPuT_anxR
 devflow_engine/devin2/pi_runner.py,sha256=xRl-qA3RgMFgiR5fnG6fTwwL95PMk6zVdRdFa-fXy2E,7466
 devflow_engine/error/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 devflow_engine/error/remediation.py,sha256=Z4LJQzZPzb7_6tea_XtasDvFYQiEdpkFlyxoCEO1I2k,548
-devflow_engine/errors/error_solver_dag.py,sha256=U7n6pgt95SIePgFDPNMp_OFOW8Eq0Nyw29Kjf7XBf9E,59446
+devflow_engine/errors/error_solver_dag.py,sha256=jwFewUFxZPUurHrT2WGk85antB5w2S5TEMCUq9sy3k0,61429
 devflow_engine/errors/question_classifier.py,sha256=oBJ29hszG--TUna62BQHnNmi6hPwf-wEE8eGLmgS624,9729
 devflow_engine/errors/repo_quality_judge.py,sha256=LVBaXN6AsID-x8qb-IriQKYY1c9AMMRNo-tWMeiuMaA,9962
 devflow_engine/errors/runtime_observability.py,sha256=Do93Ah3vxLEocYtC0JpnRIRQN6uNAOkYjBz0pmOqg5g,29719
@@ -382,7 +382,7 @@ devflow_engine/prompts/source_doc_mutation/source_doc_enrichment_coherence/promp
 devflow_engine/prompts/source_doc_mutation/user_workflows/prompt.md,sha256=2Bv-EkZwzxtPSsDGdw9YuuuzT1c_2R9c6HPSMdP-MD0,406
 devflow_engine/prompts/source_scope/doctrine/prompt.md,sha256=AJk1gfePTdaBSw5DHvCr7Sigsk2orGaRVNZ3Dj3NdcQ,837
 devflow_engine/prompts/ui_grounding/doctrine/prompt.md,sha256=0L5y-QjjquPABqxAHZNPkcjyHMZQSDRVncNDQa2app0,409
-devflow_engine-1.2.2.dist-info/METADATA,sha256=gs_L91c1G3EHidj1wi52bGWurkduxKak2V5DlW2yKdM,7755
-devflow_engine-1.2.2.dist-info/WHEEL,sha256=lCkmxWfQsSc9CfIClYeavTdQeEX2toPqufh9gI35EQA,87
-devflow_engine-1.2.2.dist-info/entry_points.txt,sha256=U5Pw4y4v4u4xcRS5DbXfemBg0RKp74kMxcnEoL0MACY,99
-devflow_engine-1.2.2.dist-info/RECORD,,
+devflow_engine-1.2.4.dist-info/METADATA,sha256=6RFdShXKS6HOlHJ7MWGIukO1KPwM--VG8Bz8TSx-3fU,7755
+devflow_engine-1.2.4.dist-info/WHEEL,sha256=lCkmxWfQsSc9CfIClYeavTdQeEX2toPqufh9gI35EQA,87
+devflow_engine-1.2.4.dist-info/entry_points.txt,sha256=U5Pw4y4v4u4xcRS5DbXfemBg0RKp74kMxcnEoL0MACY,99
+devflow_engine-1.2.4.dist-info/RECORD,,