devflow-engine 1.2.2__tar.gz → 1.2.4__tar.gz

{devflow_engine-1.2.2 → devflow_engine-1.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devflow-engine
-Version: 1.2.2
+Version: 1.2.4
 Summary: DevFlow v2 CLI-first engine (projects, stories, execution store, review packets)
 Author: DevFlow
 License: Proprietary

{devflow_engine-1.2.2 → devflow_engine-1.2.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "devflow-engine"
-version = "1.2.2"
+version = "1.2.4"
 description = "DevFlow v2 CLI-first engine (projects, stories, execution store, review packets)"
 readme = "README.md"
 requires-python = ">=3.11"

{devflow_engine-1.2.2 → devflow_engine-1.2.4}/src/devflow_engine/errors/error_solver_dag.py

@@ -244,7 +244,49 @@ def _validate_ui_fix_proof(
     return True, normalized, None
 
 
-def _validate_ui_observability_repro(observation: dict[str, Any]) -> tuple[bool, str | None]:
+def _artifact_under_observability_sandbox(artifact: str, *, error_task_id: str) -> bool:
+    normalized = artifact.replace("\\", "/").strip()
+    allowed_prefixes = (
+        f".devflow/observability/{error_task_id}/",
+        ".devflow/observability/<id>/",
+    )
+    if any(normalized.startswith(prefix) for prefix in allowed_prefixes):
+        return True
+    marker = f"/.devflow/observability/{error_task_id}/"
+    return marker in normalized
+
+
+def _command_targets_observability_sandbox(command: str, *, error_task_id: str) -> bool:
+    normalized = command.replace("\\", "/").strip()
+    allowed_fragments = (
+        f".devflow/observability/{error_task_id}/",
+        ".devflow/observability/<id>/",
+        f"/.devflow/observability/{error_task_id}/",
+    )
+    return any(fragment in normalized for fragment in allowed_fragments)
+
+
+def _repro_tests_under_observability_sandbox(
+    repro_tests: object,
+    *,
+    error_task_id: str,
+) -> bool:
+    if not isinstance(repro_tests, list):
+        return True
+    for test in repro_tests:
+        if not isinstance(test, dict):
+            continue
+        path = str(test.get("file") or test.get("path") or "").strip()
+        if path and not _artifact_under_observability_sandbox(path, error_task_id=error_task_id):
+            return False
+    return True
+
+
+def _validate_ui_observability_repro(
+    observation: dict[str, Any],
+    *,
+    error_task_id: str,
+) -> tuple[bool, str | None]:
     artifact = str(observation.get("repro_artifact_path") or "").strip()
     command = str(observation.get("repro_run_command") or "").strip()
     output = str(observation.get("repro_output") or "").strip()
@@ -256,6 +298,15 @@ def _validate_ui_observability_repro(observation: dict[str, Any]) -> tuple[bool,
         return False, "ui_observability_missing_playwright_repro_artifact"
     if "playwright" not in command.lower():
         return False, "ui_observability_requires_playwright_repro_command"
+    if not _artifact_under_observability_sandbox(artifact, error_task_id=error_task_id):
+        return False, "ui_observability_repro_artifact_outside_sandbox"
+    if not _command_targets_observability_sandbox(command, error_task_id=error_task_id):
+        return False, "ui_observability_repro_command_outside_sandbox"
+    if not _repro_tests_under_observability_sandbox(
+        observation.get("repro_tests"),
+        error_task_id=error_task_id,
+    ):
+        return False, "ui_observability_repro_test_outside_sandbox"
     if not output:
         return False, "ui_observability_missing_repro_output"
     if not isinstance(oracles, list) or not any(str(o or "").strip() for o in oracles):
@@ -876,7 +927,10 @@ class BuildObservabilityNode(Node):
                     else {}
                 )
                 if observed_flag and _ui_proof_required({"runtimeContext": user_report_context_for_ui}):
-                    ui_repro_ok, ui_repro_failure_reason = _validate_ui_observability_repro(observation)
+                    ui_repro_ok, ui_repro_failure_reason = _validate_ui_observability_repro(
+                        observation,
+                        error_task_id=error_task_id,
+                    )
 
                 # Split deferred questions via LLM classifier (v1.1.22).
                 # An injectable hook is used when present so tests can

{devflow_engine-1.2.2 → devflow_engine-1.2.4}/tests/area8_errors/test_us85_ui_playwright_proof_gate.py

@@ -43,8 +43,10 @@ def _observed_ui_repro() -> dict:
         "deferred_questions": [],
         "confidence": "high",
         "observed": True,
-        "repro_artifact_path": "admin-frontend/tests/industry-dropdown.spec.ts",
-        "repro_run_command": "npx playwright test admin-frontend/tests/industry-dropdown.spec.ts --project=chromium",
+        "repro_artifact_path": ".devflow/observability/<id>/industry-dropdown.spec.ts",
+        "repro_run_command": (
+            "npx playwright test .devflow/observability/<id>/industry-dropdown.spec.ts --project=chromium"
+        ),
         "repro_output": "expect(locator).toBeVisible failed before fix",
         "repro_oracles": [
             "Clicking the Industry / sector combobox should reveal the options list.",
@@ -93,6 +95,133 @@ def test_ui_user_report_does_not_reach_fix_without_playwright_observability_repr
     assert "Create or extend a Playwright test" in stored["required_next_action"]
 
 
+def test_ui_user_report_does_not_reach_fix_with_repro_artifact_outside_sandbox(tmp_path: Path) -> None:
+    repo_root = tmp_path / "repo"
+    repo_root.mkdir()
+    _init_repo(repo_root)
+    store = ExecutionStore(repo_root / ".devflow" / "execution.sqlite")
+    etid = _seed_ui_report(store, external_id="ui-product-path-repro")
+    first_pass_called = {"n": 0}
+
+    observation = _observed_ui_repro()
+    observation["repro_artifact_path"] = "admin-frontend/tests/industry-dropdown.spec.ts"
+    observation["repro_run_command"] = (
+        "npx playwright test admin-frontend/tests/industry-dropdown.spec.ts --project=chromium"
+    )
+
+    def fix_fn(_ctx):
+        first_pass_called["n"] += 1
+        return {"fixed": True, "verification": {"green_gate": True}}
+
+    result = store.run_error_solver_dag(
+        error_task_id=etid,
+        repo_root=repo_root,
+        build_observability_fn=lambda _ctx: {"observable": True, "observation": observation},
+        first_pass_fix_fn=fix_fn,
+        iterative_fix_fn=lambda _ctx: {"fixed": False},
+        needs_user_input_fn=lambda _ctx: False,
+    )
+
+    assert first_pass_called["n"] == 0
+    assert result["outcome"] == "observation_inconclusive"
+    with store._connect() as conn:
+        row = conn.execute(
+            "SELECT status, observability_json FROM error_tasks WHERE error_task_id=?",
+            (etid,),
+        ).fetchone()
+    assert row["status"] == "observation_inconclusive"
+    stored = json.loads(row["observability_json"])
+    assert stored["observability_error"] == "ui_observability_repro_artifact_outside_sandbox"
+    assert stored["observed"] is False
+
+
+def test_ui_user_report_does_not_reach_fix_with_repro_command_outside_sandbox(tmp_path: Path) -> None:
+    repo_root = tmp_path / "repo"
+    repo_root.mkdir()
+    _init_repo(repo_root)
+    store = ExecutionStore(repo_root / ".devflow" / "execution.sqlite")
+    etid = _seed_ui_report(store, external_id="ui-product-command-repro")
+    first_pass_called = {"n": 0}
+
+    observation = _observed_ui_repro()
+    observation["repro_artifact_path"] = f".devflow/observability/{etid}/industry-dropdown.spec.ts"
+    observation["repro_run_command"] = (
+        "cd admin-frontend && npx playwright test tests/e2e/industry-dropdown.spec.ts --project=chromium"
+    )
+
+    def fix_fn(_ctx):
+        first_pass_called["n"] += 1
+        return {"fixed": True, "verification": {"green_gate": True}}
+
+    result = store.run_error_solver_dag(
+        error_task_id=etid,
+        repo_root=repo_root,
+        build_observability_fn=lambda _ctx: {"observable": True, "observation": observation},
+        first_pass_fix_fn=fix_fn,
+        iterative_fix_fn=lambda _ctx: {"fixed": False},
+        needs_user_input_fn=lambda _ctx: False,
+    )
+
+    assert first_pass_called["n"] == 0
+    assert result["outcome"] == "observation_inconclusive"
+    with store._connect() as conn:
+        row = conn.execute(
+            "SELECT status, observability_json FROM error_tasks WHERE error_task_id=?",
+            (etid,),
+        ).fetchone()
+    assert row["status"] == "observation_inconclusive"
+    stored = json.loads(row["observability_json"])
+    assert stored["observability_error"] == "ui_observability_repro_command_outside_sandbox"
+    assert stored["observed"] is False
+
+
+def test_ui_user_report_does_not_reach_fix_with_repro_test_outside_sandbox(tmp_path: Path) -> None:
+    repo_root = tmp_path / "repo"
+    repo_root.mkdir()
+    _init_repo(repo_root)
+    store = ExecutionStore(repo_root / ".devflow" / "execution.sqlite")
+    etid = _seed_ui_report(store, external_id="ui-product-repro-test-entry")
+    first_pass_called = {"n": 0}
+
+    observation = _observed_ui_repro()
+    observation["repro_artifact_path"] = f".devflow/observability/{etid}/industry-dropdown.spec.ts"
+    observation["repro_run_command"] = (
+        f"npx playwright test .devflow/observability/{etid}/industry-dropdown.spec.ts --project=chromium"
+    )
+    observation["repro_tests"] = [
+        {
+            "file": "admin-frontend/tests/e2e/industry-dropdown.spec.ts",
+            "language": "TypeScript",
+            "name": "industry dropdown opens",
+        }
+    ]
+
+    def fix_fn(_ctx):
+        first_pass_called["n"] += 1
+        return {"fixed": True, "verification": {"green_gate": True}}
+
+    result = store.run_error_solver_dag(
+        error_task_id=etid,
+        repo_root=repo_root,
+        build_observability_fn=lambda _ctx: {"observable": True, "observation": observation},
+        first_pass_fix_fn=fix_fn,
+        iterative_fix_fn=lambda _ctx: {"fixed": False},
+        needs_user_input_fn=lambda _ctx: False,
+    )
+
+    assert first_pass_called["n"] == 0
+    assert result["outcome"] == "observation_inconclusive"
+    with store._connect() as conn:
+        row = conn.execute(
+            "SELECT status, observability_json FROM error_tasks WHERE error_task_id=?",
+            (etid,),
+        ).fetchone()
+    assert row["status"] == "observation_inconclusive"
+    stored = json.loads(row["observability_json"])
+    assert stored["observability_error"] == "ui_observability_repro_test_outside_sandbox"
+    assert stored["observed"] is False
+
+
 def test_ui_user_report_does_not_resolve_without_playwright_video_proof(tmp_path: Path) -> None:
     repo_root = tmp_path / "repo"
     repo_root.mkdir()

{devflow_engine-1.2.2 → devflow_engine-1.2.4}/uv.lock

@@ -172,7 +172,7 @@ wheels = [
 
 [[package]]
 name = "devflow-engine"
-version = "1.2.2"
+version = "1.2.4"
 source = { editable = "." }
 dependencies = [
     { name = "cryptography" },