monkeybot 3.0.2__tar.gz → 3.0.4__tar.gz

{monkeybot-3.0.2 → monkeybot-3.0.4}/.github/workflows/ci.yml

@@ -19,7 +19,7 @@ jobs:
           version: "latest"
 
       - name: Sync dependencies
-        run: uv sync --extra claude --extra vertex-claude --extra bedrock
+        run: uv sync --extra claude --extra vertex-claude --extra bedrock --extra firestore
 
       - name: Mypy
         run: uv run mypy src/monkeybot

{monkeybot-3.0.2 → monkeybot-3.0.4}/CHANGELOG.md

@@ -6,6 +6,30 @@ the project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+### CLI
+
+### Changed
+
+- CLI extras catalog / `monkeybot new` provider menu lists `ollama-cloud` and `ollama-local` instead of a single `ollama` row. `--with ollama` and `--provider ollama` still work.
+
+## [core v3.0.4] - 2026-08-28
+
+### Added
+
+- Explicit `ollama-cloud` and `ollama-local` provider ids so Cloud always hits `https://ollama.com` even when a leftover local `OLLAMA_BASE_URL` is set. Legacy `ollama` still auto-routes from env.
+
+## [core v3.0.3] - 2026-08-23
+
+### Added
+
+- Local computer control: nine opt-in, macOS-only `computer_*` tools (`computer/`) let the agent open/reveal files and folders, launch apps, open URLs, read/write the clipboard, and list/find/move/trash files under the user's home directory. Off by default (`computer.enabled: false` / `MONKEYBOT_COMPUTER_TOOLS`); intended for the Monkeybot desktop app, never a server deployment. Every call asks for approval by default via a built-in ruleset baseline (not `permissions.yaml`, which is fail-open); "Always allow" is scoped to the exact `(tool, resource)` approved and persists durably to `monkeybot_config/approvals.json` (a new machine-written file — never hand-edit). Hard security limits (home-directory confinement, credential-path denylist, exec-surface refusal on `open`, trash-not-delete) live in the tool bodies and cannot be bypassed by permission rules. See `docs/features.md` §22.
+- `permissions.yaml`'s `tool-confirmations` approval now supports a durable `persist` hook (`remember_always_approval(..., persist=...)`) in addition to the existing in-session `SessionApprovals` cache; `resource_for_call` gained `url`/`app` argument lookups for readable permission resource strings on tools with no `path` arg.
+
+### Fixed
+
+- Anthropic SDK 1.0 removed `temperature` / `top_p` / `top_k` from `messages.stream()`. Filter stream kwargs to the callable signature and retry `TypeError: unexpected keyword argument` so Claude/Bedrock streams no longer die before the request.
+- Stop during a tool confirmation sets the turn cancel Event in `POST /cancel` (and on realtime interrupt) before pending futures are cancelled, so completed tool results settle into history instead of racing a 50ms poller. Session DELETE and websocket teardown leave the Event unset and propagate cancellation. Spill writes refuse an uncontained `_` symlink fallback; transcript and attachment dirs reuse a safe pre-sanitization folder when it still exists on disk. Attachment reads also reject symlinked attachment ids that resolve outside the workspace.
+
 ## [core v3.0.2] - 2026-08-18
 
 ### Fixed
@@ -37,6 +61,9 @@ the project adheres to [Semantic Versioning](https://semver.org/).
 
 ### Fixed
 
+- Stop during a tool confirmation now settles completed tool results into history (and synthesizes cancel envelopes for the rest) instead of escaping before abort settlement; the realtime confirm path does the same. Cancel after a finished provider stream also persists already-shown assistant text so follow-ups match what the user saw, and settles any finalized tool calls with cancel envelopes.
+- SQLite `history.reset` (compaction / load-max truncate) runs delete+reinsert in one transaction, matching Postgres, so a crash mid-reset cannot wipe or partially rewrite a thread.
+- Tool spill paths sanitize client `session_id` / `thread_id` components and refuse to write or delete outside `.monkeybot/spill`; `POST /sessions` rejects path-traversal session ids; session DELETE quiesces the active turn before removing spill dirs. The same path-component sanitizer also applies to transcript and attachment directories, so legacy ids containing glob metacharacters map to a sanitized on-disk folder (reads still find a pre-sanitization folder when it exists).
 - Streamable HTTP MCP connects accept both 2-tuple and 3-tuple transport yields from the MCP Python SDK.
 - Stop mid-reply now cancels the in-flight provider token stream (instead of waiting for the full LLM call) and persists any already-streamed assistant text to history so follow-up turns keep matching what the user saw.
 - Chunking improvements now reach existing workspaces: a chunker version bump re-chunks indexed files even when their modification time never changed, so upgrades no longer require deleting `.monkeybot/knowledge/`.

{monkeybot-3.0.2 → monkeybot-3.0.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: monkeybot
-Version: 3.0.2
+Version: 3.0.4
 Summary: monkeybot agent harness — FastAPI SSE gateway, owned loop, SQLite, and MCP.
 License: MIT
 License-File: LICENSE
@@ -191,6 +191,13 @@ Clone only if you are changing the harness. Setup, checks, and the release workf
 
 Search or open an issue in the [GitHub issue tracker](https://github.com/human-plus-machine/monkeybot/issues).
 
+## Credits
+
+MonkeyBot builds on two open-source projects:
+
+- [Browser Use](https://github.com/browser-use/browser-use) — browser automation for the [browser MCP](docs/browser-mcp.md) (via [browser-harness](https://github.com/browser-use/browser-harness) and the interactive-element DOM walker). MIT licensed.
+- [OpenSandbox](https://github.com/opensandbox-group/OpenSandbox) — sandbox runtime used for isolated `run_command` / code execution. Apache-2.0 licensed.
+
 ## License
 
 MIT — see [`LICENSE`](LICENSE).

{monkeybot-3.0.2 → monkeybot-3.0.4}/README.md

@@ -93,6 +93,13 @@ Clone only if you are changing the harness. Setup, checks, and the release workf
 
 Search or open an issue in the [GitHub issue tracker](https://github.com/human-plus-machine/monkeybot/issues).
 
+## Credits
+
+MonkeyBot builds on two open-source projects:
+
+- [Browser Use](https://github.com/browser-use/browser-use) — browser automation for the [browser MCP](docs/browser-mcp.md) (via [browser-harness](https://github.com/browser-use/browser-harness) and the interactive-element DOM walker). MIT licensed.
+- [OpenSandbox](https://github.com/opensandbox-group/OpenSandbox) — sandbox runtime used for isolated `run_command` / code execution. Apache-2.0 licensed.
+
 ## License
 
 MIT — see [`LICENSE`](LICENSE).

{monkeybot-3.0.2 → monkeybot-3.0.4}/cli/skills/monkeybot/SKILL.md

@@ -111,7 +111,9 @@ uv sync
 | `vertex-claude` | `GCP_PROJECT_ID` / `GOOGLE_CLOUD_PROJECT` / `ANTHROPIC_VERTEX_PROJECT_ID` (ADC) | `monkeybot[vertex-claude]` |
 | `aws_bedrock` | `AWS_ACCESS_KEY_ID` / `AWS_PROFILE` + `AWS_REGION` | `monkeybot[bedrock]` |
 | `huggingface` | `HF_TOKEN` (or `HUGGINGFACE_API_KEY`) | `monkeybot[huggingface]` |
-| `ollama` | None required — `OLLAMA_BASE_URL` (default `http://localhost:11434`) for a non-default server | `monkeybot[ollama]` |
+| `ollama-cloud` | `OLLAMA_API_KEY` | `monkeybot[ollama]` |
+| `ollama-local` | None required — `OLLAMA_BASE_URL` (default `http://localhost:11434`) | `monkeybot[ollama]` |
+| `ollama` | Legacy auto-route (key + blank URL = cloud; explicit URL wins) | `monkeybot[ollama]` |
 
 **Agent-first dependencies.** The CLI is thin — it does **not** install provider/storage extras globally. `monkeybot new` scaffolds a `pyproject.toml` with the selected provider (and any `--with` extras). Run plain `uv sync` in the agent directory. `monkeybot run` / `chat` spawn the gateway from that project's interpreter (`.venv/bin/python`, else `uv run python`), and `doctor` checks extras in that same interpreter. For a config-only tree (just `monkeybot_config/`, no `pyproject.toml`) the gateway uses the CLI's interpreter when it already has MonkeyBot 3.x (and MemPalace if memory is on). If memory is enabled and that interpreter cannot import MemPalace, `run` / `chat` provision a cached CLI-managed venv under `~/.cache/monkeybot/runtimes/` holding `monkeybot[memory]` pinned to the running core (never rewrites a `pyproject.toml`). `doctor` reuses that cache when it is already present. Otherwise extras must be installed in the CLI env (`uv tool install --with 'monkeybot[<extra>]' monkeybot-cli`).
 

{monkeybot-3.0.2 → monkeybot-3.0.4}/cli/skills/monkeybot/references/config-sections.md

@@ -45,7 +45,7 @@ Validate check ids: `paths.agent_md.exists`, `paths.skills_path.exists`, `paths.
 | `max_turns` | `1000` | Hard cap on turns per run |
 | `summarization_model` | (main model) | Cheaper model for history summarization (env `CONTEXT_SUMMARIZATION_MODEL`) |
 
-Validate check ids: `model.provider.supported`, `model.name.present`. Supported YAML providers: `gemini`/`vertex`, `openai`, `anthropic`, `vertex-claude`, `huggingface`, `ollama`, `aws_bedrock`, `fake`.
+Validate check ids: `model.provider.supported`, `model.name.present`. Supported YAML providers: `gemini`/`vertex`, `openai`, `anthropic`, `vertex-claude`, `huggingface`, `ollama-cloud`, `ollama-local`, `ollama`, `aws_bedrock`, `fake`.
 
 ## `gcp` / `anthropic_vertex` (non-secret identifiers)
 

{monkeybot-3.0.2 → monkeybot-3.0.4}/cli/src/monkeybot_cli/chat_local_shell.py

@@ -5,54 +5,18 @@ Output is local-only — never sent to the agent.
 
 from __future__ import annotations
 
-import os
-import signal
 import subprocess
 import sys
 import threading
 from pathlib import Path
 
-_IS_WINDOWS = sys.platform == "win32"
+from monkeybot_cli.process_tree import IS_WINDOWS, kill_process_tree, popen_kwargs_for_platform
 
 # Cap capture before TUI truncation so `!yes`-style floods cannot OOM the process.
 _MAX_CAPTURE_CHARS = 100_000
 _READ_CHUNK = 4_096
 
 
-def _popen_kwargs_for_platform() -> dict[str, object]:
-    if _IS_WINDOWS:
-        # getattr fallback: this constant only exists on Windows builds of
-        # `subprocess`, so a plain attribute access breaks importing/testing
-        # this module on POSIX even though the branch never runs there.
-        return {"creationflags": getattr(subprocess, "CREATE_NEW_PROCESS_GROUP", 0)}
-    return {"start_new_session": True}
-
-
-def _kill_process_tree(pid: int) -> None:
-    """Best-effort kill of the shell process group/tree.
-
-    Swallow lookup/permission races — leader exit can make killpg raise
-    ``PermissionError`` even though descendants still need a signal.
-    """
-    if _IS_WINDOWS:
-        try:
-            subprocess.run(
-                ["taskkill", "/F", "/T", "/PID", str(pid)],
-                capture_output=True,
-                check=False,
-            )
-        except OSError:
-            pass
-        return
-    try:
-        os.killpg(pid, signal.SIGKILL)
-    except (ProcessLookupError, PermissionError, OSError):
-        try:
-            os.kill(pid, signal.SIGKILL)
-        except (ProcessLookupError, PermissionError, OSError):
-            pass
-
-
 def _append_capped(chunks: list[str], total: int, data: str) -> tuple[int, bool]:
     """Append ``data`` up to the capture cap. Returns (new_total, hit_cap)."""
     remain = _MAX_CAPTURE_CHARS - total
@@ -84,7 +48,7 @@ def run_local_shell(command: str, cwd: Path, *, timeout: float = 120.0) -> tuple
         stdout=subprocess.PIPE,
         stderr=subprocess.STDOUT,
         text=True,
-        **_popen_kwargs_for_platform(),
+        **popen_kwargs_for_platform(),
     )
     assert proc.stdout is not None
 
@@ -104,7 +68,7 @@ def run_local_shell(command: str, cwd: Path, *, timeout: float = 120.0) -> tuple
                 state["total"], hit = _append_capped(chunks, state["total"], chunk)
                 if hit:
                     state["capped"] = True
-                    _kill_process_tree(proc.pid)
+                    kill_process_tree(proc.pid)
                     break
         except (ValueError, OSError):
             # stdout closed from the main thread to unblock a stuck read.
@@ -119,12 +83,12 @@ def run_local_shell(command: str, cwd: Path, *, timeout: float = 120.0) -> tuple
             proc.wait(timeout=timeout)
         except subprocess.TimeoutExpired:
             timed_out = True
-            _kill_process_tree(proc.pid)
+            kill_process_tree(proc.pid)
 
         # Shell may have exited while a descendant still holds the pipe —
         # kill the tree and close stdout so the reader cannot block forever.
         if reader.is_alive():
-            _kill_process_tree(proc.pid)
+            kill_process_tree(proc.pid)
             stop_reader.set()
             try:
                 proc.stdout.close()
@@ -139,7 +103,7 @@ def run_local_shell(command: str, cwd: Path, *, timeout: float = 120.0) -> tuple
             reader.join(timeout=0.1)
     except Exception:
         timed_out = True
-        _kill_process_tree(proc.pid)
+        kill_process_tree(proc.pid)
         stop_reader.set()
         try:
             proc.stdout.close()
@@ -149,7 +113,7 @@ def run_local_shell(command: str, cwd: Path, *, timeout: float = 120.0) -> tuple
 
     try:
         if proc.poll() is None:
-            _kill_process_tree(proc.pid)
+            kill_process_tree(proc.pid)
             try:
                 proc.wait(timeout=1)
             except Exception:

monkeybot-3.0.4/cli/src/monkeybot_cli/commands/run_cmd.py

@@ -0,0 +1,197 @@
+"""monkeybot run — launch the SSE gateway as a subprocess."""
+
+from __future__ import annotations
+
+import argparse
+import os
+import signal
+import subprocess
+import sys
+import time
+from collections.abc import Callable
+from pathlib import Path
+from types import FrameType
+from typing import Any
+
+from monkeybot_cli.config_resolve import (
+    load_agent_dotenv,
+    load_config_doc,
+    resolve_agent_root,
+    resolve_config,
+)
+from monkeybot_cli.opensandbox_lifecycle import (
+    ensure_opensandbox_for_agent,
+    is_sandbox_enabled,
+    server_url_from_config,
+)
+from monkeybot_cli.process_tree import IS_WINDOWS, kill_process_tree, popen_kwargs_for_platform
+from monkeybot_cli.runtime_python import gateway_argv, prepare_runtime_python
+
+_SHUTDOWN_TIMEOUT_SECS = 5.0
+_KILL_TIMEOUT_SECS = 1.0
+_Handler = Callable[[int, FrameType | None], Any] | int | None
+
+
+def _cli_exit_status(rc: int | None, received: int | None) -> int:
+    """Map a child ``wait()`` status to a CLI exit code.
+
+    ``wait()`` returns a negative signal number when the child dies from a
+    signal; ``SystemExit(-15)`` becomes shell status 241. Unix convention is
+    ``128 + signal`` (143 for SIGTERM, 130 for SIGINT).
+
+    When the shim received SIGINT, return 130 even if the child exited 0 —
+    that matches the conventional Ctrl-C exit status.
+    """
+    if received == signal.SIGINT:
+        return 130
+    if rc is None:
+        return 1
+    if rc < 0:
+        return 128 + (-rc)
+    return rc
+
+
+def _signal_process_group(proc: subprocess.Popen[bytes], signum: int) -> None:
+    if proc.poll() is not None:
+        return
+    if IS_WINDOWS:
+        try:
+            proc.send_signal(signum)
+        except OSError as exc:
+            print(f"failed to signal gateway: {exc}", file=sys.stderr)
+        return
+    try:
+        os.killpg(proc.pid, signum)
+        return
+    except ProcessLookupError:
+        return
+    except OSError as exc:
+        try:
+            proc.send_signal(signum)
+        except OSError:
+            print(f"failed to signal gateway: {exc}", file=sys.stderr)
+
+
+def run_gateway_process(
+    cmd: list[str],
+    *,
+    env: dict[str, str],
+    cwd: Path,
+    shutdown_timeout: float = _SHUTDOWN_TIMEOUT_SECS,
+    kill_timeout: float = _KILL_TIMEOUT_SECS,
+) -> int:
+    """Start the gateway and forward stop signals to its process group.
+
+    Electron sends SIGTERM only to this CLI shim. ``subprocess.run`` dies on
+    that signal and leaves uvicorn holding the port. On POSIX the child is
+    started in a new session so SIGTERM/SIGINT reach the whole tree (``uv run``
+    plus the gateway grandchild), then escalate to SIGKILL if it ignores the
+    signal for ``shutdown_timeout`` seconds.
+
+    ``start_new_session`` also detaches the gateway from the terminal's
+    foreground process group (stdin reads would raise SIGTTIN). That is fine
+    for uvicorn today and required for ``killpg``.
+
+    On Windows, ``send_signal(SIGTERM)`` only terminates the immediate child;
+    grandchildren may still be orphaned.
+
+    Interactive Ctrl-C already hits the foreground process group; forwarding
+    SIGINT matters here because the child is in a new session and would
+    otherwise keep running.
+    """
+    received: int | None = None
+    proc: subprocess.Popen[bytes] | None = None
+    signal_forwarded = False
+    deadline: float | None = None
+
+    def _forward(signum: int, _frame: object | None) -> None:
+        nonlocal received, signal_forwarded, deadline
+        if received is None:
+            received = signum
+        if proc is not None:
+            _signal_process_group(proc, signum)
+            signal_forwarded = True
+            if deadline is None:
+                deadline = time.monotonic() + shutdown_timeout
+
+    restored: dict[int, _Handler] = {}
+    forwarded = [signal.SIGINT, signal.SIGTERM]
+    if not IS_WINDOWS:
+        forwarded.append(signal.SIGHUP)
+    for sig in forwarded:
+        try:
+            restored[sig] = signal.signal(sig, _forward)
+        except (ValueError, OSError) as exc:
+            print(f"failed to install {sig.name} handler: {exc}", file=sys.stderr)
+    try:
+        proc = subprocess.Popen(
+            cmd,
+            env=env,
+            cwd=cwd,
+            **popen_kwargs_for_platform(),
+        )
+        if received is not None and not signal_forwarded:
+            _signal_process_group(proc, received)
+            if deadline is None:
+                deadline = time.monotonic() + shutdown_timeout
+        while True:
+            try:
+                rc = proc.wait(timeout=0.25)
+            except subprocess.TimeoutExpired:
+                if deadline is None or time.monotonic() < deadline:
+                    continue
+                print(
+                    "gateway did not exit after signal; killing process tree",
+                    file=sys.stderr,
+                )
+                kill_process_tree(proc.pid)
+                try:
+                    proc.wait(timeout=kill_timeout)
+                except subprocess.TimeoutExpired:
+                    print("gateway still running after kill", file=sys.stderr)
+                rc = proc.returncode
+            return _cli_exit_status(rc, received)
+    finally:
+        for sig, handler in restored.items():
+            try:
+                signal.signal(sig, handler)
+            except (ValueError, OSError) as exc:
+                print(f"failed to restore {sig.name} handler: {exc}", file=sys.stderr)
+
+
+def run_run(args: argparse.Namespace) -> int:
+    cwd = Path(args.cwd).expanduser().resolve() if args.cwd else None
+    config_path = resolve_config(args.config, cwd=cwd)
+    load_agent_dotenv(cwd=cwd, config_path=config_path)
+    env = os.environ.copy()
+    if config_path is not None:
+        env["MONKEYBOT_CONFIG"] = str(config_path)
+    if args.port:
+        env["PORT"] = str(args.port)
+    # --cwd intentionally pins the subprocess and runtime directory. Without
+    # it, an explicit config determines the agent root.
+    agent_root = resolve_agent_root(cwd=cwd, config_path=config_path)
+    if config_path is not None:
+        _, cfg_doc = load_config_doc(config_path)
+        if is_sandbox_enabled(cfg_doc):
+            if not ensure_opensandbox_for_agent(
+                agent_root,
+                server_url=server_url_from_config(cfg_doc),
+                # Fail fast: Mac app health-checks the gateway immediately.
+                docker_wait_secs=2.0,
+            ):
+                print(
+                    "Continuing without a healthy OpenSandbox — run_command may fail.",
+                    flush=True,
+                )
+    runtime = prepare_runtime_python(agent_root, config_path)
+    cmd = gateway_argv(runtime)
+    return run_gateway_process(cmd, env=env, cwd=agent_root)
+
+
+def register(subparsers: argparse._SubParsersAction[argparse.ArgumentParser]) -> None:
+    p = subparsers.add_parser("run", help="Start the monkeybot SSE gateway")
+    p.add_argument("--config", help="Path to monkeybot.yaml (sets MONKEYBOT_CONFIG)")
+    p.add_argument("--port", type=int, help="Listen port (sets PORT)")
+    p.add_argument("--cwd", help="Working directory for the gateway process")
+    p.set_defaults(func=run_run)

{monkeybot-3.0.2 → monkeybot-3.0.4}/cli/src/monkeybot_cli/extras_catalog.py

@@ -24,7 +24,8 @@ PROVIDER_CHOICES: tuple[ExtraChoice, ...] = (
     ExtraChoice("vertex-claude", "Claude on Vertex AI"),
     ExtraChoice("aws_bedrock", "AWS Bedrock"),
     ExtraChoice("huggingface", "Hugging Face"),
-    ExtraChoice("ollama", "Ollama (local)"),
+    ExtraChoice("ollama-cloud", "Ollama Cloud"),
+    ExtraChoice("ollama-local", "Ollama (local)"),
     ExtraChoice("nvidia", "NVIDIA NIM"),
     ExtraChoice("openrouter", "OpenRouter"),
 )

monkeybot-3.0.4/cli/src/monkeybot_cli/process_tree.py

@@ -0,0 +1,44 @@
+"""Shared helpers for spawning and tearing down process groups/trees."""
+
+from __future__ import annotations
+
+import os
+import signal
+import subprocess
+import sys
+
+IS_WINDOWS = sys.platform == "win32"
+
+
+def popen_kwargs_for_platform() -> dict[str, object]:
+    if IS_WINDOWS:
+        # getattr fallback: this constant only exists on Windows builds of
+        # `subprocess`, so a plain attribute access breaks importing/testing
+        # this module on POSIX even though the branch never runs there.
+        return {"creationflags": getattr(subprocess, "CREATE_NEW_PROCESS_GROUP", 0)}
+    return {"start_new_session": True}
+
+
+def kill_process_tree(pid: int) -> None:
+    """Best-effort kill of the shell process group/tree.
+
+    Swallow lookup/permission races — leader exit can make killpg raise
+    ``PermissionError`` even though descendants still need a signal.
+    """
+    if IS_WINDOWS:
+        try:
+            subprocess.run(
+                ["taskkill", "/F", "/T", "/PID", str(pid)],
+                capture_output=True,
+                check=False,
+            )
+        except OSError:
+            pass
+        return
+    try:
+        os.killpg(pid, signal.SIGKILL)
+    except (ProcessLookupError, PermissionError, OSError):
+        try:
+            os.kill(pid, signal.SIGKILL)
+        except (ProcessLookupError, PermissionError, OSError):
+            pass

{monkeybot-3.0.2 → monkeybot-3.0.4}/cli/src/monkeybot_cli/providers.py

@@ -59,6 +59,17 @@ PROVIDER_SPECS: dict[str, ProviderSpec] = {
         (),
         credentials_optional=True,
     ),
+    "ollama-cloud": ProviderSpec(
+        ("ollama-cloud", "ollama_cloud"),
+        "ollama",
+        ("OLLAMA_API_KEY",),
+    ),
+    "ollama-local": ProviderSpec(
+        ("ollama-local", "ollama_local"),
+        "ollama",
+        (),
+        credentials_optional=True,
+    ),
     "fake": ProviderSpec(("fake",), None, (), credentials_optional=True),
 }
 

{monkeybot-3.0.2 → monkeybot-3.0.4}/cli/src/monkeybot_cli/scaffold.py

@@ -138,6 +138,7 @@ def ensure_workspace(dest: Path, *, force: bool) -> list[str]:
         "browser/playbooks",
         "browser/Screenshots",
         "generated-media/images",
+        "generated-media/video",
     ):
         path = workspace / rel
         path.mkdir(parents=True, exist_ok=True)

{monkeybot-3.0.2 → monkeybot-3.0.4}/cli/src/monkeybot_cli/scaffold_defaults/env.example

@@ -28,7 +28,10 @@ DB_URL=sqlite:///data/monkeybot.db
 # Hugging Face
 # HF_TOKEN=
 
-# Ollama (local models — no API key needed)
+# Ollama Cloud (model.provider: ollama-cloud) — key from ollama.com/settings/keys
+# OLLAMA_API_KEY=
+
+# Ollama local (model.provider: ollama-local) — no API key needed
 # OLLAMA_BASE_URL=http://localhost:11434
 
 # Optional web search

{monkeybot-3.0.2 → monkeybot-3.0.4}/cli/src/monkeybot_cli/scaffold_defaults/monkeybot.example.yaml

@@ -87,7 +87,7 @@ paths:
   workspace_root: ./workspace
 
 model:
-  # gemini | openai | anthropic | vertex-claude | huggingface | ollama | nvidia | openrouter | aws_bedrock | fake
+  # gemini | openai | anthropic | vertex-claude | huggingface | ollama-cloud | ollama-local | ollama | nvidia | openrouter | aws_bedrock | fake
   provider: gemini
   name: gemini-3.1-flash-live-preview
   temperature: 0.7
@@ -214,6 +214,18 @@ todo_list:
   enabled: true
   mirror_to_disk: true
 
+# Desktop-only, macOS-only local computer control (open/reveal files & folders,
+# launch apps, read/write the clipboard, browse/move/trash files) via
+# computer_* tools. Off by default — server/Cloud Run deployments should never
+# set this. The Monkeybot desktop app sets MONKEYBOT_COMPUTER_TOOLS when it
+# spawns a gateway with this feature turned on in its settings; every computer_*
+# call still asks for approval by default (a built-in permissions.yaml baseline,
+# not configurable here) and "Always allow" is scoped to the exact action, not
+# the whole tool. See monkeybot_config/permissions.yaml and
+# monkeybot_config/approvals.json (machine-written, do not hand-edit).
+computer:
+  enabled: false
+
 sandbox:
   # Opt-in: requires Docker Desktop (OpenSandbox). Leave false for normal Mac
   # installs so the gateway starts without Docker. When enabled, ``monkeybot run``

{monkeybot-3.0.2 → monkeybot-3.0.4}/cli/tests/test_chat_local_shell.py

@@ -8,6 +8,7 @@ import time
 from pathlib import Path
 
 import monkeybot_cli.chat_local_shell as chat_local_shell
+import monkeybot_cli.process_tree as process_tree
 from monkeybot_cli.chat_local_shell import run_local_shell, truncate_output
 
 
@@ -30,7 +31,7 @@ def test_run_local_shell_uses_cwd(tmp_path: Path) -> None:
 
 
 def test_kill_process_tree_swallows_permission_error(monkeypatch) -> None:
-    monkeypatch.setattr(chat_local_shell, "_IS_WINDOWS", False)
+    monkeypatch.setattr(process_tree, "IS_WINDOWS", False)
 
     def _boom_killpg(pid: int, sig: int) -> None:
         raise PermissionError("race")
@@ -38,9 +39,9 @@ def test_kill_process_tree_swallows_permission_error(monkeypatch) -> None:
     def _boom_kill(pid: int, sig: int) -> None:
         raise ProcessLookupError()
 
-    monkeypatch.setattr(chat_local_shell.os, "killpg", _boom_killpg)
-    monkeypatch.setattr(chat_local_shell.os, "kill", _boom_kill)
-    chat_local_shell._kill_process_tree(4321)  # must not raise
+    monkeypatch.setattr(process_tree.os, "killpg", _boom_killpg)
+    monkeypatch.setattr(process_tree.os, "kill", _boom_kill)
+    process_tree.kill_process_tree(4321)  # must not raise
 
 
 def test_run_local_shell_timeout(tmp_path: Path) -> None:
@@ -104,22 +105,22 @@ def test_run_local_shell_timeout_kills_grandchildren(tmp_path: Path) -> None:
 
 
 def test_popen_kwargs_use_process_group_on_posix(monkeypatch) -> None:
-    monkeypatch.setattr(chat_local_shell, "_IS_WINDOWS", False)
-    assert chat_local_shell._popen_kwargs_for_platform() == {"start_new_session": True}
+    monkeypatch.setattr(process_tree, "IS_WINDOWS", False)
+    assert process_tree.popen_kwargs_for_platform() == {"start_new_session": True}
 
 
 def test_popen_kwargs_use_new_process_group_on_windows(monkeypatch) -> None:
-    monkeypatch.setattr(chat_local_shell, "_IS_WINDOWS", True)
-    kwargs = chat_local_shell._popen_kwargs_for_platform()
+    monkeypatch.setattr(process_tree, "IS_WINDOWS", True)
+    kwargs = process_tree.popen_kwargs_for_platform()
     assert set(kwargs) == {"creationflags"}
 
 
 def test_kill_process_tree_uses_killpg_on_posix(monkeypatch) -> None:
-    monkeypatch.setattr(chat_local_shell, "_IS_WINDOWS", False)
+    monkeypatch.setattr(process_tree, "IS_WINDOWS", False)
     calls: list[tuple[int, int]] = []
-    monkeypatch.setattr(chat_local_shell.os, "killpg", lambda pid, sig: calls.append((pid, sig)))
-    chat_local_shell._kill_process_tree(4321)
-    assert calls == [(4321, chat_local_shell.signal.SIGKILL)]
+    monkeypatch.setattr(process_tree.os, "killpg", lambda pid, sig: calls.append((pid, sig)))
+    process_tree.kill_process_tree(4321)
+    assert calls == [(4321, process_tree.signal.SIGKILL)]
 
 
 def test_kill_process_tree_uses_taskkill_on_windows(monkeypatch) -> None:
@@ -128,14 +129,14 @@ def test_kill_process_tree_uses_taskkill_on_windows(monkeypatch) -> None:
     os.killpg doesn't exist on Windows, so the POSIX-only kill path would
     crash a timed-out `!` command instead of finishing the tool block there.
     """
-    monkeypatch.setattr(chat_local_shell, "_IS_WINDOWS", True)
+    monkeypatch.setattr(process_tree, "IS_WINDOWS", True)
     calls: list[list[str]] = []
     monkeypatch.setattr(
-        chat_local_shell.subprocess,
+        process_tree.subprocess,
         "run",
         lambda argv, **kwargs: calls.append(list(argv)),
     )
-    chat_local_shell._kill_process_tree(4321)
+    process_tree.kill_process_tree(4321)
     assert calls == [["taskkill", "/F", "/T", "/PID", "4321"]]
 
 

{monkeybot-3.0.2 → monkeybot-3.0.4}/cli/tests/test_extras_catalog.py

@@ -21,6 +21,8 @@ def test_normalize_extra_token_features_and_providers() -> None:
     assert normalize_extra_token("anthropic") == "claude"
     assert normalize_extra_token("aws_bedrock") == "bedrock"
     assert normalize_extra_token("claude") == "claude"
+    assert normalize_extra_token("ollama-cloud") == "ollama"
+    assert normalize_extra_token("ollama-local") == "ollama"
     assert normalize_extra_token("fake") is None
     assert normalize_extra_token("not-a-real-extra") is None
 
@@ -42,6 +44,9 @@ def test_extra_module_covers_catalog_extras() -> None:
 def test_provider_extra_name() -> None:
     assert provider_extra_name("openai") == "openai"
     assert provider_extra_name("anthropic") == "claude"
+    assert provider_extra_name("ollama-cloud") == "ollama"
+    assert provider_extra_name("ollama-local") == "ollama"
+    assert provider_extra_name("ollama") == "ollama"
     assert provider_extra_name("fake") is None