monkeybot 3.0.0__tar.gz → 3.0.2__tar.gz

{monkeybot-3.0.0 → monkeybot-3.0.2}/CHANGELOG.md

@@ -6,6 +6,18 @@ the project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [core v3.0.2] - 2026-08-18
+
+### Fixed
+
+- Compute-only OpenSandbox (`SANDBOX_SHARED_FILESYSTEM=false`) no longer rejects every `run_command` when the harness passes the default workspace-root cwd. Nested workspace cwd and workspace/skills path args are still refused.
+
+## [core v3.0.1] - 2026-08-18
+
+### Fixed
+
+- Host `run_command` no longer fail-closes every command when filesystem isolation is unavailable and none of the memory hidden paths exist on disk (typical in nested Linux containers with memory off). Isolation is still required — and the command still refused — when at least one palace path is present.
+
 ## [core v3.0.0] - 2026-08-17
 
 ### Breaking

{monkeybot-3.0.0 → monkeybot-3.0.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: monkeybot
-Version: 3.0.0
+Version: 3.0.2
 Summary: monkeybot agent harness — FastAPI SSE gateway, owned loop, SQLite, and MCP.
 License: MIT
 License-File: LICENSE

{monkeybot-3.0.0 → monkeybot-3.0.2}/docs/features.md

@@ -445,7 +445,7 @@ Each section follows: **Purpose** · **Key files** · **How it works** · **Depe
 **Invariants:**
 - Chat history is canonical; MemPalace drawers are an idempotent projection.
 - Recall is scoped to the current `thread_id` by default.
-- `memory.enabled: false` (or `MONKEYBOT_MEMORY_HOOK_ENABLED=0`) skips capture, wake-up, and prompt teaching. Host `run_command` children then cannot see palace files: Linux user+mount namespaces or macOS `sandbox-exec` hide those directories. If that isolation cannot be established, the command is refused rather than run with palace files visible. OpenSandbox does not mount the palace. The kill switch is not an argv denylist; `bash` remains allowed, and the OS hides the files.
+- `memory.enabled: false` (or `MONKEYBOT_MEMORY_HOOK_ENABLED=0`) skips capture, wake-up, and prompt teaching. Host `run_command` children then cannot see palace files: Linux user+mount namespaces or macOS `sandbox-exec` hide those directories. If isolation cannot be established and at least one hidden palace path exists, the command is refused rather than run with palace files visible. If none of the hidden paths exist on disk, the command runs unwrapped (memory was never configured; nothing to hide). OpenSandbox does not mount the palace. The kill switch is not an argv denylist; `bash` remains allowed, and the OS hides the files.
 - Postgres/Firestore persist the memory outbox with replica `palace_id` claim partitioning. Replicated deployments must share a lock-capable palace volume.
 - MemPalace (chromadb / onnxruntime) is the optional `monkeybot[memory]` extra. Missing the extra disables memory instead of failing startup.
 - Subagents can read the palace but do not register duplicate automatic-ingest hooks.

{monkeybot-3.0.0 → monkeybot-3.0.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "monkeybot"
-version = "3.0.0"
+version = "3.0.2"
 description = "monkeybot agent harness — FastAPI SSE gateway, owned loop, SQLite, and MCP."
 requires-python = ">=3.11"
 readme = "README.md"

{monkeybot-3.0.0 → monkeybot-3.0.2}/src/monkeybot/core/tools/sandbox_executor.py

@@ -304,7 +304,17 @@ class SandboxExecutor:
         if command == "mempalace":
             validate_mempalace_subcommand(args)
 
-        if not self._config.shared_filesystem and self._remote_requests_mounted_path(args, cwd):
+        # CoreToolExecutor always passes cwd=workspace root. Compute-only already
+        # forces working_directory=/tmp, so the default harness cwd must not trip
+        # the mounted-path guard. Nested paths under workspace are still rejected.
+        check_cwd = cwd
+        if not self._config.shared_filesystem and cwd is not None:
+            if Path(cwd).resolve() == self._workspace_root:
+                check_cwd = None
+
+        if not self._config.shared_filesystem and self._remote_requests_mounted_path(
+            args, check_cwd
+        ):
             raise SecurityError(
                 "remote sandbox is compute-only and cannot access workspace or skills files"
             )

{monkeybot-3.0.0 → monkeybot-3.0.2}/src/monkeybot/core/tools/terminal.py

@@ -403,13 +403,28 @@ class TerminalExecutor:
     async def _isolate(self, executable: str, args: list[str]) -> tuple[str, list[str]]:
         """Wrap argv so hidden paths are absent from the child's filesystem.
 
-        If this host cannot hide those paths, refuse to exec. Argument
-        validation is not a sandbox: a shell can build any path at runtime.
+        If this host cannot hide those paths, refuse to exec when any of them
+        exist on disk. Argument validation is not a sandbox: a shell can
+        build any path at runtime. Missing hidden paths with no isolation
+        available means memory was never configured — nothing to hide.
         """
         if not self._hidden_paths:
             return executable, args
         support = await asyncio.to_thread(isolation_support)
         if not support.available:
+            existing = [path for path in self._hidden_paths if path.expanduser().exists()]
+            if not existing:
+                logger.info(
+                    "Filesystem isolation is unavailable on this host (%s); "
+                    "running unwrapped because none of the hidden paths exist "
+                    "(nothing to hide).",
+                    support.detail,
+                    extra={
+                        "component": "terminal_executor",
+                        "hidden_paths": [str(path) for path in self._hidden_paths],
+                    },
+                )
+                return executable, args
             raise SecurityError(
                 "Filesystem isolation is unavailable on this host "
                 f"({support.detail}); refusing to run commands while memory "

{monkeybot-3.0.0 → monkeybot-3.0.2}/tests/core/test_sandbox_executor.py

@@ -364,6 +364,24 @@ class TestSandboxExecutorLayoutMounts:
         assert mock_cls.create.call_args.kwargs["volumes"] == []
         assert sandbox.commands.run.call_args.kwargs["opts"].working_directory == "/tmp"
 
+    @pytest.mark.asyncio
+    async def test_remote_compute_mode_allows_default_workspace_cwd(self, tmp_path):
+        workspace = tmp_path / "workspace"
+        workspace.mkdir()
+        cfg = SandboxConfig(
+            True, "https://remote.example", None, "test", 30, shared_filesystem=False
+        )
+        executor = SandboxExecutor(cfg, workspace)
+        mock_cls, sandbox = _make_create_mock()
+        osb = _make_opensandbox_module(mock_cls)
+
+        with patch.dict(sys.modules, _opensandbox_sys_modules(osb)):
+            result = await executor.execute("python3", ["--version"], cwd=workspace)
+
+        assert result.exit_code == 0
+        mock_cls.create.assert_called_once()
+        assert sandbox.commands.run.call_args.kwargs["opts"].working_directory == "/tmp"
+
     @pytest.mark.asyncio
     async def test_remote_compute_mode_rejects_paths_under_workspace_or_skills(self, tmp_path):
         workspace = tmp_path / "workspace"

{monkeybot-3.0.0 → monkeybot-3.0.2}/tests/core/test_terminal.py

@@ -876,18 +876,39 @@ class TestTerminalExecutorIsolationFallback:
 
     @pytest.mark.asyncio
     async def test_unavailable_isolation_refuses_to_run(self, tmp_path, monkeypatch):
+        palace = tmp_path / "memory"
+        palace.mkdir()
         monkeypatch.setattr(
             terminal_module,
             "isolation_support",
             lambda: IsolationSupport("none", "probe says no"),
         )
         executor = TerminalExecutor(
-            allowed_path_prefixes=[str(tmp_path)], hidden_paths=[tmp_path / "memory"]
+            allowed_path_prefixes=[str(tmp_path)], hidden_paths=[palace]
         )
 
         with pytest.raises(SecurityError, match="Filesystem isolation is unavailable"):
             await executor.execute("echo", ["should-not-run"])
 
+    @pytest.mark.asyncio
+    async def test_unavailable_isolation_runs_when_nothing_exists_to_hide(
+        self, tmp_path, monkeypatch
+    ):
+        monkeypatch.setattr(
+            terminal_module,
+            "isolation_support",
+            lambda: IsolationSupport("none", "probe says no"),
+        )
+        executor = TerminalExecutor(
+            allowed_path_prefixes=[str(tmp_path)],
+            hidden_paths=[tmp_path / "missing-palace"],
+        )
+
+        result = await executor.execute("echo", ["ok-to-run"])
+
+        assert result.exit_code == 0
+        assert "ok-to-run" in result.stdout
+
     @pytest.mark.asyncio
     async def test_failed_isolation_setup_raises_security_error(self, tmp_path, monkeypatch):
         def broken_argv(executable, args, hidden_paths, *, support):

{monkeybot-3.0.0 → monkeybot-3.0.2}/uv.lock

@@ -2346,7 +2346,7 @@ wheels = [
 
 [[package]]
 name = "monkeybot"
-version = "3.0.0"
+version = "3.0.1"
 source = { editable = "." }
 dependencies = [
     { name = "aiosqlite" },