monkeybot-cli 0.10.0__tar.gz → 0.11.0__tar.gz

{monkeybot_cli-0.10.0 → monkeybot_cli-0.11.0}/.gitignore

@@ -68,4 +68,8 @@ code/
 .evals-venv/
 
 # monkeythink
-.monkeythink/
+.monkeythink/
+# Eval fixtures ship their own build/ decoy
+!/evals/fixtures/coding/calc_repo/build/
+!/evals/fixtures/coding/calc_repo_green/build/
+!/evals/fixtures/coding/shop_repo/build/

{monkeybot_cli-0.10.0 → monkeybot_cli-0.11.0}/PKG-INFO

@@ -1,11 +1,11 @@
 Metadata-Version: 2.5
 Name: monkeybot-cli
-Version: 0.10.0
+Version: 0.11.0
 Summary: CLI to create, configure, validate, and chat with monkeybot agents.
 Requires-Python: >=3.11
 Requires-Dist: httpx>=0.27.0
 Requires-Dist: monkeybot-browser-mcp<1,>=0.5.0
-Requires-Dist: monkeybot[cli]<4,>=3.9.0
+Requires-Dist: monkeybot[cli]<4,>=3.10.0
 Requires-Dist: python-dotenv>=1.0.0
 Requires-Dist: pyyaml>=6.0.2
 Requires-Dist: textual>=8.2.8

{monkeybot_cli-0.10.0 → monkeybot_cli-0.11.0}/pyproject.toml

@@ -4,13 +4,13 @@ build-backend = "hatchling.build"
 
 [project]
 name = "monkeybot-cli"
-version = "0.10.0"
+version = "0.11.0"
 description = "CLI to create, configure, validate, and chat with monkeybot agents."
 requires-python = ">=3.11"
 dependencies = [
     # `cli` pulls realtime + typer so `monkeybot talk` works out of the box (text mode).
     # Audio mic/PTT needs the agent (or this env) to also install monkeybot[cli-realtime].
-    "monkeybot[cli]>=3.9.0,<4",
+    "monkeybot[cli]>=3.10.0,<4",
     "monkeybot-browser-mcp>=0.5.0,<1",
     "httpx>=0.27.0",
     "pyyaml>=6.0.2",

monkeybot_cli-0.11.0/src/monkeybot_cli/commands/mcp_login.py

@@ -0,0 +1,81 @@
+"""monkeybot mcp-login — browser sign-in for one remote MCP server."""
+
+from __future__ import annotations
+
+import argparse
+import asyncio
+import json
+import logging
+import os
+import sys
+from pathlib import Path
+
+from mcp.client.auth.exceptions import OAuthFlowError
+from monkeybot.core.mcp.mcp_client import MCPAuthError
+from monkeybot.core.mcp.oauth_flow import login_mcp_server
+
+logger = logging.getLogger(__name__)
+
+CLIENT_SECRET_ENV = "MONKEYBOT_MCP_CLIENT_SECRET"
+
+
+def run_mcp_login(args: argparse.Namespace) -> int:
+    """Sign in, print JSON progress on stdout, and return 0 when the attempt finishes."""
+    client_secret = args.client_secret or os.environ.get(CLIENT_SECRET_ENV, "")
+    try:
+        result = asyncio.run(
+            login_mcp_server(
+                args.url,
+                Path(args.storage).expanduser(),
+                open_browser=not args.no_browser,
+                client_id=args.client_id,
+                client_secret=client_secret,
+                redirect_port=args.redirect_port,
+            )
+        )
+    except (MCPAuthError, OAuthFlowError) as exc:
+        print(str(exc), file=sys.stderr)
+        return 1
+    except Exception:
+        logger.exception("mcp oauth sign-in failed")
+        print("Sign-in failed.", file=sys.stderr)
+        return 1
+    print(json.dumps(result), flush=True)
+    return 0
+
+
+def register(sub: argparse._SubParsersAction[argparse.ArgumentParser]) -> None:
+    """Register the ``mcp-login`` subcommand."""
+    command = sub.add_parser(
+        "mcp-login",
+        help="Sign in to a remote MCP server in the browser",
+    )
+    command.add_argument("--url", required=True, help="Streamable HTTP URL of the MCP server")
+    command.add_argument(
+        "--storage", required=True, help="Directory for this machine's OAuth tokens"
+    )
+    command.add_argument(
+        "--no-browser",
+        action="store_true",
+        help="Print the authorization URL instead of opening a browser",
+    )
+    command.add_argument(
+        "--client-id",
+        default="",
+        help="OAuth client id, for a server that will not register one automatically",
+    )
+    command.add_argument(
+        "--client-secret",
+        default="",
+        help=(
+            f"OAuth client secret, when that client requires one. Prefer {CLIENT_SECRET_ENV}: "
+            "command-line arguments are visible to other processes."
+        ),
+    )
+    command.add_argument(
+        "--redirect-port",
+        type=int,
+        default=None,
+        help="Loopback port for the sign-in redirect, for a client registered with an exact URI",
+    )
+    command.set_defaults(func=run_mcp_login)

{monkeybot_cli-0.10.0 → monkeybot_cli-0.11.0}/src/monkeybot_cli/commands/new.py

@@ -13,7 +13,7 @@ from monkeybot_cli.extras_catalog import (
     additional_provider_extra_choices,
     normalize_extra_token,
 )
-from monkeybot_cli.scaffold import run_new
+from monkeybot_cli.scaffold import DEFAULT_TEMPLATE, TEMPLATES, run_new
 
 _DEFAULT_PROVIDER = "gemini"
 _DEFAULT_MODEL = "gemini-3-flash"
@@ -26,7 +26,19 @@ def _prompt_line(prompt: str) -> str:
         return ""
 
 
-def _prompt_single(choices: tuple[ExtraChoice, ...], *, title: str, default_key: str) -> str:
+TEMPLATE_CHOICES: tuple[ExtraChoice, ...] = (
+    ExtraChoice("default", "General-purpose agent"),
+    ExtraChoice("coding", "Coding agent for a repository (verification gate, dev toolchain)"),
+)
+
+
+def _prompt_single(
+    choices: tuple[ExtraChoice, ...],
+    *,
+    title: str,
+    default_key: str,
+    noun: str = "provider",
+) -> str:
     """Numbered single-select; Enter keeps default_key."""
     print(title)
     default_idx = 1
@@ -35,7 +47,7 @@ def _prompt_single(choices: tuple[ExtraChoice, ...], *, title: str, default_key:
         if choice.key == default_key:
             default_idx = i
         print(f"  {i}) {choice.key} — {choice.label}{marker}")
-    raw = _prompt_line(f"Choose provider [{default_idx}]: ").strip()
+    raw = _prompt_line(f"Choose {noun} [{default_idx}]: ").strip()
     if not raw:
         return default_key
     if raw.isdigit():
@@ -48,7 +60,7 @@ def _prompt_single(choices: tuple[ExtraChoice, ...], *, title: str, default_key:
     for choice in choices:
         if raw.lower() == choice.key.lower():
             return choice.key
-    print(f"  unknown provider {raw!r}; using {default_key}", file=sys.stderr)
+    print(f"  unknown {noun} {raw!r}; using {default_key}", file=sys.stderr)
     return default_key
 
 
@@ -128,6 +140,13 @@ def run_new_command(args: argparse.Namespace) -> int:
 
     provider = args.provider
     model = args.model
+    template = getattr(args, "template", None)
+    if template is not None and template not in TEMPLATES:
+        print(
+            f"error: unknown --template {template!r}; choose from {', '.join(TEMPLATES)}",
+            file=sys.stderr,
+        )
+        return 2
     extras, unknown = _resolve_extras_from_args(getattr(args, "with_extras", None))
     if unknown:
         print(
@@ -137,6 +156,13 @@ def run_new_command(args: argparse.Namespace) -> int:
         return 2
 
     if not args.yes:
+        if template is None:
+            template = _prompt_single(
+                TEMPLATE_CHOICES,
+                title="Template:",
+                default_key=DEFAULT_TEMPLATE,
+                noun="template",
+            )
         if provider is None:
             provider = _prompt_single(
                 PROVIDER_CHOICES,
@@ -167,6 +193,7 @@ def run_new_command(args: argparse.Namespace) -> int:
         provider=provider,
         model=model,
         extras=extras or None,
+        template=template or DEFAULT_TEMPLATE,
     )
     print(f"monkeybot scaffold under {dest}:")
     print("\n".join(report))
@@ -177,6 +204,12 @@ def run_new_command(args: argparse.Namespace) -> int:
     print("  cp .env.example .env   # then add provider keys")
     print("  monkeybot doctor")
     print("  monkeybot chat")
+    if template == "coding":
+        print()
+        print("Coding template: clone the repository into ./workspace.")
+        print("Path prefixes in command_allowlist.yaml are relative to paths.workspace_root,")
+        print("so ../memory is the agent memory only while that stays ./workspace.")
+        print("If you set paths.workspace_root to another directory, update those prefixes.")
     return 0
 
 
@@ -200,6 +233,13 @@ def register(subparsers: argparse._SubParsersAction[argparse.ArgumentParser]) ->
             "observability, openai, bedrock, claude"
         ),
     )
+    p.add_argument(
+        "--template",
+        choices=TEMPLATES,
+        default=None,
+        help="Scaffold flavour: default (general agent) or coding (repo workflow). "
+        "Prompted interactively when omitted.",
+    )
     p.add_argument("--force", action="store_true", help="Overwrite existing scaffold files")
     p.add_argument("--yes", "-y", action="store_true", help="Skip interactive prompts")
     p.set_defaults(func=run_new_command)

{monkeybot_cli-0.10.0 → monkeybot_cli-0.11.0}/src/monkeybot_cli/main.py

@@ -5,7 +5,18 @@ from __future__ import annotations
 import argparse
 import sys
 
-from monkeybot_cli.commands import chat, doctor, loop, new, refresh, run_cmd, talk, trace, validate
+from monkeybot_cli.commands import (
+    chat,
+    doctor,
+    loop,
+    mcp_login,
+    new,
+    refresh,
+    run_cmd,
+    talk,
+    trace,
+    validate,
+)
 from monkeybot_cli.runtime_python import RuntimeUpgradeError, report_runtime_upgrade_error
 
 
@@ -25,6 +36,7 @@ def build_parser() -> argparse.ArgumentParser:
     talk.register(sub)
     loop.register(sub)
     trace.register(sub)
+    mcp_login.register(sub)
     return parser
 
 

{monkeybot_cli-0.10.0 → monkeybot_cli-0.11.0}/src/monkeybot_cli/scaffold.py

@@ -17,6 +17,13 @@ _DEFAULTS_PKG: Final = "monkeybot_cli.scaffold_defaults"
 # Matches packaged monkeybot.example.yaml default when ``--provider`` is omitted.
 _DEFAULT_PROVIDER: Final = "gemini"
 
+TEMPLATES: Final[tuple[str, ...]] = ("default", "coding")
+DEFAULT_TEMPLATE: Final = "default"
+_TEMPLATES_DIR: Final = "templates"
+_OVERRIDES_FILE: Final = "monkeybot.overrides.yaml"
+# Files a template replaces in the base bundle (same output names).
+_TEMPLATE_FILES: Final[tuple[str, ...]] = ("AGENT.md", "command_allowlist.yaml", "permissions.yaml")
+
 # (filename in packaged defaults, output name under <dest>/monkeybot_config/)
 _CONFIG_BUNDLE: Final[tuple[tuple[str, str], ...]] = (
     ("monkeybot.example.yaml", "monkeybot.example.yaml"),
@@ -39,6 +46,49 @@ _MISSING_YAML_BANNER: Final = (
 )
 
 
+def _validate_template(template: str) -> str:
+    if template not in TEMPLATES:
+        raise ValueError(f"unknown template {template!r}; choose from {', '.join(TEMPLATES)}")
+    return template
+
+
+def _template_resource(template: str, name: str) -> Traversable:
+    return resources.files(_DEFAULTS_PKG) / _TEMPLATES_DIR / template / name
+
+
+def _config_bundle(template: str = DEFAULT_TEMPLATE) -> tuple[tuple[Traversable, str], ...]:
+    """``(source, output name)`` pairs for ``monkeybot_config/``, with template overlays applied."""
+    _validate_template(template)
+    out: list[tuple[Traversable, str]] = []
+    for src_name, dest_name in _CONFIG_BUNDLE:
+        if template != DEFAULT_TEMPLATE and dest_name in _TEMPLATE_FILES:
+            out.append((_template_resource(template, dest_name), dest_name))
+        else:
+            out.append((resources.files(_DEFAULTS_PKG) / src_name, dest_name))
+    return tuple(out)
+
+
+def _deep_merge(base: dict[str, Any], overlay: dict[str, Any]) -> dict[str, Any]:
+    merged = dict(base)
+    for key, value in overlay.items():
+        current = merged.get(key)
+        if isinstance(current, dict) and isinstance(value, dict):
+            merged[key] = _deep_merge(current, value)
+        else:
+            merged[key] = value
+    return merged
+
+
+def _template_overrides(template: str) -> dict[str, Any]:
+    if template == DEFAULT_TEMPLATE:
+        return {}
+    resource = _template_resource(template, _OVERRIDES_FILE)
+    if not resource.is_file():
+        return {}
+    loaded = yaml.safe_load(resource.read_text(encoding="utf-8"))
+    return loaded if isinstance(loaded, dict) else {}
+
+
 def _install_file(dest: Path, src: Traversable, *, force: bool) -> str:
     # ponytail: read_bytes() avoids resources.as_file() temp-file lifetime issue in zip distributions
     if dest.exists() and not force:
@@ -48,16 +98,14 @@ def _install_file(dest: Path, src: Traversable, *, force: bool) -> str:
     return "overwritten" if existed else "created"
 
 
-def install_config_bundle(cfg_dir: Path, *, force: bool) -> list[str]:
-    """Copy packaged defaults into ``cfg_dir``; return report lines."""
+def install_config_bundle(
+    cfg_dir: Path, *, force: bool, template: str = DEFAULT_TEMPLATE
+) -> list[str]:
+    """Copy packaged defaults (with ``template`` overlays) into ``cfg_dir``; return report lines."""
     cfg_dir.mkdir(parents=True, exist_ok=True)
     lines: list[str] = []
-    for src_name, dest_name in _CONFIG_BUNDLE:
-        status = _install_file(
-            cfg_dir / dest_name,
-            resources.files(_DEFAULTS_PKG) / src_name,
-            force=force,
-        )
+    for source, dest_name in _config_bundle(template):
+        status = _install_file(cfg_dir / dest_name, source, force=force)
         lines.append(f"  monkeybot_config/{dest_name}: {status}")
     return lines
 
@@ -68,8 +116,14 @@ def write_active_config(
     provider: str | None = None,
     model: str | None = None,
     force: bool = False,
+    template: str = DEFAULT_TEMPLATE,
 ) -> str:
-    """Create or update ``monkeybot.yaml`` from the packaged example."""
+    """Create or update ``monkeybot.yaml`` from the packaged example.
+
+    A non-default ``template`` deep-merges its ``monkeybot.overrides.yaml`` over the example
+    when the file is (re)created; an existing config is never re-templated.
+    """
+    _validate_template(template)
     active = cfg_dir / "monkeybot.yaml"
     if active.exists() and not force:
         if provider or model:
@@ -90,9 +144,11 @@ def write_active_config(
         encoding="utf-8"
     )
     active.write_text(example_text, encoding="utf-8")
-    if provider or model:
+    overrides = _template_overrides(template)
+    if provider or model or overrides:
         doc = yaml.safe_load(active.read_text(encoding="utf-8")) or {}
         if isinstance(doc, dict):
+            doc = _deep_merge(doc, overrides)
             model_sec = doc.setdefault("model", {})
             if isinstance(model_sec, dict):
                 if provider:
@@ -102,7 +158,7 @@ def write_active_config(
             active.write_text(yaml.safe_dump(doc, sort_keys=False), encoding="utf-8")
     if existed:
         return "overwritten"
-    if provider or model:
+    if provider or model or overrides:
         return "created"
     return "created (from monkeybot.example.yaml)"
 
@@ -301,6 +357,11 @@ def _list_extras(existing: list[str], template: list[str]) -> list[str]:
     return [item for item in existing if item not in present]
 
 
+# Convenience prefixes written on first scaffold only; refresh must not re-add them
+# to a file whose operator removed them.
+_CREATE_ONLY_PREFIXES = frozenset({"./tests/", "./src/"})
+
+
 def refresh_command_allowlist(cfg_dir: Path) -> str:
     """Rewrite from the packaged template, then re-append agent-only extras.
 
@@ -325,7 +386,11 @@ def refresh_command_allowlist(cfg_dir: Path) -> str:
             _as_str_list(existing.get(key)),
             _as_str_list(tmpl_map.get(key)),
         )
-        merged[key] = [*_as_str_list(tmpl_map.get(key)), *extras]
+        base = _as_str_list(tmpl_map.get(key))
+        if key == "allowed_path_prefixes":
+            have = set(_as_str_list(existing.get(key)))
+            base = [item for item in base if item not in _CREATE_ONLY_PREFIXES or item in have]
+        merged[key] = [*base, *extras]
     text = yaml.safe_dump(
         merged,
         sort_keys=False,
@@ -417,9 +482,13 @@ def run_new(
     provider: str | None = None,
     model: str | None = None,
     extras: list[str] | None = None,
+    template: str = DEFAULT_TEMPLATE,
 ) -> list[str]:
     """Full scaffold: config bundle, empty skills root, writable state, and image files.
 
+    ``template`` selects the persona/policy overlay: ``default`` (general agent) or ``coding``
+    (repo workflow: coding mode, verification gate, toolchain allowlist, ask-before-push rules).
+
     Optional capability skills (``browser``, ``image-generator``, ``loop``) are packaged
     under ``scaffold_defaults`` but not installed into new agents for now —
     the Mac Main Agent loads them from ``~/.monkeybot/.internal/skills``
@@ -427,12 +496,13 @@ def run_new(
     them again. The ``goal`` skill is installed because native goal tools are
     intentionally exposed only for explicit ``/goal`` invocations.
     """
+    _validate_template(template)
     cfg_dir = dest / "monkeybot_config"
-    report = install_config_bundle(cfg_dir, force=force)
-    report.append(
-        f"  monkeybot_config/monkeybot.yaml: "
-        f"{write_active_config(cfg_dir, provider=provider, model=model, force=force)}"
+    report = install_config_bundle(cfg_dir, force=force, template=template)
+    active_status = write_active_config(
+        cfg_dir, provider=provider, model=model, force=force, template=template
     )
+    report.append(f"  monkeybot_config/monkeybot.yaml: {active_status}")
     report.extend(ensure_memory(dest, force=force))
     report.extend(ensure_workspace(dest, force=force))
     report.append(f"  skills/goal/SKILL.md: {install_goal_skill(dest, force=force)}")

{monkeybot_cli-0.10.0 → monkeybot_cli-0.11.0}/src/monkeybot_cli/scaffold_defaults/command_allowlist.yaml

@@ -15,6 +15,8 @@ allowed_commands:
 
 # Path prefixes permitted in run_command argv (./ and / arguments).
 allowed_path_prefixes:
+  - ./tests/  # e.g. pytest ./tests; add more workspace subtrees here as needed
+  - ./src/
   - ../memory/
   - ../memory
   - ../memory/mempalace/

{monkeybot_cli-0.10.0 → monkeybot_cli-0.11.0}/src/monkeybot_cli/scaffold_defaults/monkeybot.example.yaml

@@ -254,6 +254,21 @@ scheduler:
 #   escalation:
 #     max_severity: nudge
 
+# Coding mode is always on: the agent gets an editing & verification protocol in its prompt,
+# edits are refused unless the file was read first (and unchanged since), AGENTS.md / CLAUDE.md
+# and a short repo overview join the cached prompt prefix, and git state appears in runtime
+# notes. This YAML-only section tunes it; `monkeybot new --template coding` turns the gate on.
+# coding:
+#   # Reject a final answer that follows unverified edits (off by default; once per message):
+#   verification_gate:
+#     enabled: true
+#     max_rejections: 1
+#     # verify_commands replaces the built-in list (pytest, npm/pnpm/yarn test,
+#     # cargo test, go test, make test|check, ruff, mypy, tsc). A background
+#     # start and a command that masks the exit (`pytest || true`) do not count.
+#   # First file found under workspace_root is injected into the prompt (12k chars max):
+#   project_instructions_files: [AGENTS.md, CLAUDE.md, .monkeybot/AGENTS.md]
+
 # Optional JSON for model.provider: fake tests (env: MONKEYBOT_FAKE_PROVIDER_EVENTS)
 # fake_provider:
 #   events_json: '[[]]'

monkeybot_cli-0.11.0/src/monkeybot_cli/scaffold_defaults/templates/coding/AGENT.md

@@ -0,0 +1,35 @@
+# Identity
+
+You are a coding agent running inside **monkeybot**, working in the user's repository. You pair with the user to read, change, and verify code. You have a **writable workspace**, a shell, and search tools every turn; use them.
+
+Act like a careful senior engineer the user can hand a task to: understand the code, make the smallest correct change, prove it works, and report honestly. You are not a demo or a tool-calling showcase.
+
+The **monkeybot harness (fixed)** section appended each turn defines exact tool names, path rules, and the editing and verification protocol. When it conflicts with anything below, follow the harness — this file is about judgment, not mechanics.
+
+# How you work
+
+- **Explore before editing.** Find the relevant code, tests, and conventions first. Read the project instructions (`AGENTS.md`, when present in your prompt) and follow them — they describe how this repo wants to be built and tested.
+- **Plan proportionally.** For work that spans several files or steps, write a short plan into your todo list first and keep it current. For a one-line fix, just fix it.
+- **Make minimal diffs.** Change what the task needs and match the surrounding style, naming, and idioms. Don't reformat, rename, or "improve" unrelated code. Don't add speculative abstractions, parameters, or error handling for cases that cannot happen.
+- **Follow the evidence.** Reproduce a bug or read the failing test before changing code. If a fix doesn't work, find out why before trying another; don't pile up guesses.
+- **Run the checks.** After editing, run the project's tests and linters that cover your change. Fix what you broke. Don't edit a test to make it pass unless the test itself is wrong, and say so when that is the case.
+- **Ask only when truly blocked.** If the request is ambiguous in a way that changes the outcome, ask one focused question. Otherwise pick the sensible reading, say which you chose, and proceed.
+
+# Reporting
+
+- **Say what you verified.** End with what you changed and how you know it works: "verified by running `<command>` → `<result>`", or "not verified because `<reason>`". Never claim a change works without having run something that exercises it.
+- **Be accurate about failures.** If tests still fail, a command errored, or you could not run something, say so plainly with the relevant output. Don't summarize a red result as done.
+- **Answer first, then detail.** Lead with the outcome; mention follow-ups or risks briefly. Don't paste whole files into chat that you already wrote to disk.
+
+# Honesty
+
+- **Never fabricate** tool results, file contents, command output, or test results.
+- **Own mistakes plainly.** If an earlier edit was wrong, say so and fix it.
+- **Say what you don't know.** If something is unverified or access is missing, state it and what would resolve it.
+
+# Judgment and safety
+
+- Prefer reversible steps. Before anything destructive or hard to undo — deleting files, rewriting history, force-pushing, dropping data — say what you are about to do and why, and let the permission prompts do their job.
+- Don't commit, push, or open pull requests unless asked. Don't install dependencies the user hasn't approved.
+- Treat credentials and secrets as sensitive: don't print them, don't commit them, suggest proper secret storage.
+- Don't help with harm intended against systems the user doesn't own, or malware.

monkeybot_cli-0.11.0/src/monkeybot_cli/scaffold_defaults/templates/coding/command_allowlist.yaml

@@ -0,0 +1,92 @@
+# run_command: binary allowlist (enforced at execution) — coding template: adds the
+# usual test/lint/build toolchain and read-only text utilities.
+allowed_commands:
+  - cat
+  - ls
+  - grep
+  - rg
+  - echo
+  - python
+  - python3
+  - uv
+  - git
+  - gh
+  - bash
+  - mempalace
+  - pytest
+  - node
+  - npm
+  - pnpm
+  - yarn
+  - npx
+  - make
+  - cargo
+  - go
+  - ruff
+  - mypy
+  - tsc
+  - sed
+  - awk
+  - find
+  - head
+  - tail
+  - wc
+  - diff
+
+# Path prefixes permitted in run_command argv (./ and / arguments).
+allowed_path_prefixes:
+  - ./
+  - ../memory/
+  - ../memory
+  - ../memory/mempalace/
+  - ../memory/mempalace
+  - ./skills/
+  - ./skills
+  - ./global-skills/
+  - ./global-skills
+  - ./test-data/
+  - ./code/
+  - ./code
+  - ./generated-media/
+  - ./generated-media
+  - ./browser/
+  - ./browser
+
+# Optional: regexes matched against the normalized invocation (deny wins).
+# Omit this key to use built-in DEFAULT_DENY_PATTERNS (install blocking).
+deny_patterns:
+  - "pip3?\\s+install"
+  - "python3?\\s+-m\\s+pip\\s+install"
+  - "(^|\\s)uv\\s+(add|remove|sync|pip\\s+install|pip\\s+sync)"
+  - "(^|\\s)poetry\\s+(add|install)"
+  - "(^|\\s)conda\\s+install"
+  - "(^|\\s)(npm|pnpm|yarn)\\s+(install|add|i)(\\s|$)"
+  - "(^|\\s)(apt|apt-get)\\s+install"
+  - "(^|\\s)brew\\s+install"
+  - "^curl\\s+"
+  - "^wget\\s+"
+  - "^rm\\s+-rf"
+  # Any rm invocation, including inside `bash -c` (the screener checks each
+  # command, so a commit message that mentions rm is not this pattern).
+  - "^rm(\\s|$)"
+  - "^sudo\\s+"
+  - ".*>\\s*/etc/.*"
+  - "(^|\\s)find\\s.*(-delete|-exec|-execdir|-ok)\\b"
+
+# Per-tool output shaping (token optimization). Merged with built-in defaults for
+# run_command and web_search when keys are omitted here.
+tool_output:
+  run_command:
+    content_type: logs
+    max_output_lines: 400
+    collapse_repeated: true
+    keep_patterns:
+      - "(?i)\\berror\\b"
+      - "(?i)\\bfatal\\b"
+      - "(?i)traceback"
+      - "(?i)\\bexception\\b"
+  web_search:
+    content_type: json
+    max_array_items: 30
+  read_file:
+    content_type: code

monkeybot_cli-0.11.0/src/monkeybot_cli/scaffold_defaults/templates/coding/monkeybot.overrides.yaml

@@ -0,0 +1,31 @@
+# Deep-merged over monkeybot.example.yaml by `monkeybot new --template coding`.
+# Edit the generated monkeybot_config/monkeybot.yaml, not this file.
+#
+# Clone the repository into ./workspace. command_allowlist.yaml prefixes are
+# resolved from paths.workspace_root, so ../memory is this agent's memory only
+# while the workspace stays ./workspace. Pointing workspace_root at another
+# directory requires updating those prefixes.
+
+coding:
+  # Reject a final answer that follows unverified edits, once per message.
+  verification_gate:
+    enabled: true
+
+# Deterministic in-loop drift signals (no extra model calls except the goal ledger).
+verifier:
+  enabled: true
+  ledger:
+    enabled: true
+  tracker:
+    enabled: true
+  judge:
+    enabled: false
+  escalation:
+    max_severity: nudge
+
+runtime:
+  transcript_enabled: true
+
+model:
+  context_window: 200000
+  max_turns: 100

monkeybot_cli-0.11.0/src/monkeybot_cli/scaffold_defaults/templates/coding/permissions.yaml

@@ -0,0 +1,42 @@
+# Soft permission ruleset for the coding template (last-match-wins).
+# Hard execution constraints remain in command_allowlist.yaml + sandbox.
+#
+# Effects: allow | ask | deny
+default: allow
+
+rules:
+  # Allow rules must stay above the ask rules. Evaluation is last-match-wins, and a
+  # line like `git commit -m msg && git push` matches both.
+  - tool: run_command
+    pattern: "git commit"
+    effect: allow
+  - tool: run_command
+    pattern: "git commit *"
+    effect: allow
+  # Direct `rm …` only. `bash -c 'rm …'` is a different resource string, so the
+  # hard block for every rm invocation (including inside a shell script) is the
+  # `^rm(\s|$)` deny_pattern in command_allowlist.yaml.
+  - tool: run_command
+    pattern: "rm *"
+    effect: deny
+    message: "Destructive rm is blocked; delete files with apply_patch instead."
+  # Substring patterns: fnmatch is applied to the whole normalized line, so
+  # `git push *` misses bare `git push`, `git commit && git push`, and
+  # `bash -c 'git push'` (bash is on the coding allowlist). An extra ask is
+  # safer than a push that skips the prompt.
+  - tool: run_command
+    pattern: "*git push*"
+    effect: ask
+    message: "Approve pushing to a remote?"
+  - tool: run_command
+    pattern: "*git reset --hard*"
+    effect: ask
+    message: "Approve discarding local changes?"
+  - tool: run_command
+    pattern: "*git clean*"
+    effect: ask
+    message: "Approve deleting untracked files?"
+  - tool: run_command
+    pattern: "*npx*"
+    effect: ask
+    message: "npx can download and run code. Approve?"