monkeybot 3.12.0__tar.gz → 3.14.0__tar.gz

monkeybot-3.14.0/CHANGELOG.md

@@ -0,0 +1,662 @@
+# Changelog
+
+All notable changes to monkeybot are documented in this file. The
+format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and
+the project adheres to [Semantic Versioning](https://semver.org/).
+
+## [Unreleased]
+
+## [core v3.14.0] - 2026-11-04
+
+### Added
+
+- An MCP server a chat does not use for ten model turns is hidden from that chat. The connection stays up for other chats and for subagents. `enable_mcp` shows that server's tools again. A call to a hidden server is rejected.
+
+### Fixed
+
+- A message sent while a background subagent is still running is answered. It is not treated as a request for the child's result. `await_task` runs when the user asks for that result, or when a harness note says the child has finished.
+
+## [cli v0.13.0] - 2026-11-01
+
+### Added
+
+- Chat renders a turn the gateway starts while the prompt is idle, including the follow-up when a background subagent finishes. A message sent during that turn reports the session as busy.
+
+### Fixed
+
+- `monkeybot doctor` points a config-only tree at the Pillow overrides file shipped with the CLI. A bare `uv tool install` still resolves core 3.10.0.
+- New coding scaffolds tell the image generator to use the `skills` path from `list_skills` instead of an absolute host directory.
+
+## [core v3.13.0] - 2026-11-01
+
+### Added
+
+- `task` accepts `background: true`. The child keeps running after the turn ends. `await_task` and `kill_task` read or stop it. A finished child wakes the parent with a `[harness]` follow-up while the session is idle. `MONKEYBOT_TASK_QUEUE` and the subagent worker pool are removed.
+- `write_file`, `replace_in_file`, and `apply_patch` emit a `FileChange` and keep a before/after snapshot under `.monkeybot/changes/{session}` so a client can review the diff and undo. Undo refuses a file that changed since the edit or a snapshot that was too large to keep, and the next turn is told which paths were restored.
+
+### Changed
+
+- Tool input and output, tool errors, completions, and turn I/O are no longer clipped at 8 KB in traces or at 4 KB in the SQLite trace DB. Each attribute is capped at 1 MiB instead. The history prompt stays at 8 KB. Full tool I/O now reaches OTLP backends, so redact at the collector. The SQLite DB no longer stores the `langfuse.*` mirror keys. The OTLP and SQLite exporters send 8 spans per request (override OTLP with a positive integer `OTEL_BSP_MAX_EXPORT_BATCH_SIZE`; any other value keeps 8).
+
+### Fixed
+
+- A UI-only row between a tool call and its result no longer makes the provider see two results for that call. Bedrock rejected the turn when the counts did not match. Stored history is unchanged.
+- `list_skills` advertises the workspace `skills/` mount instead of the host skills directory. `run_command` paths under `skills/` stay inside that root, so opening a skill file no longer asks for approval.
+
+## [core v3.12.0] - 2026-10-29
+
+### Added
+
+- Bedrock Converse models (Grok, Nova, Llama, and other non-Claude ids) send prompt-cache checkpoints when `model.cache_retention` is not `none`. Checkpoints land on the system prompt, the tool list, and the last two user turns, up to Bedrock's limit of four. `short` and `long` both use Converse's default 5-minute cache. A model that rejects cache points is retried once without them.
+
+## [cli v0.12.0] - 2026-10-28
+
+### Changed
+
+- Chat shows thoughts, tool calls, and web sources as one collapsed row. The reply no longer carries an assistant label.
+
+## [core v3.11.1] - 2026-10-28
+
+### Fixed
+
+- Sandbox volume names stay valid DNS labels and unique per path. The name used to be cut to 63 characters after dashes were stripped, so a cut could leave a trailing `-` and OpenSandbox rejected it with HTTP 422 on long workspace paths. Names now end in an 8-character hash of the path.
+
+## [cli v0.11.1] - 2026-10-28
+
+### Fixed
+
+- `uv tool install` of the CLI resolves again. browser-harness 0.1.13 pins Pillow 12.3.0, and declaring Pillow 13 as a normal dependency conflicts with that pin. Lock and sync already override it; tool and pip installs now pass the same override.
+- The managed memory runtime installs `monkeybot-browser-mcp` next to `monkeybot[memory]`. A cached runtime that cannot import `browser_mcp` is rebuilt, so a local CLI gateway can start the browser server with its own interpreter.
+- The managed memory runtime also installs the `web-search` extra. DuckDuckGo is the default search backend, and a cached runtime that cannot import `ddgs` is rebuilt.
+- Chat inserts a newline on Shift+Enter, Alt+Enter, and Ctrl+J. Enter still sends the message. Terminals that report those chords as a modified carriage return are recognized too.
+
+## [core v3.11.0] - 2026-10-28
+
+### Added
+
+- `POST /api/chat-title` names a chat from its first user message and first assistant reply. The title is null until that reply exists, or when the model call fails, so the caller can retry.
+- Deployments can price models the harness does not ship with. A `pricing:` section in `monkeybot.yaml` maps a model id to `input`, `output`, `cache_write`, and `cache_read` in USD per 1M tokens, with optional `aliases`. Edits to that file, or to a file it includes, apply on the next lookup without a restart. `monkeybot validate` rejects a missing, negative, unknown, or non-numeric field, a duplicate id, or an alias that is not a list of ids. Embedders can call `monkeybot.providers.pricing.register_model_pricing(...)` instead; registered rates win over YAML, which wins over the built-in table for the same id. The longest matching id wins, and a pinned agent root is not replaced by the working directory.
+
+### Changed
+
+- `grep` returns the matches it found when a scan is partial. The result stays `ok: true` with `scan_complete: false`, and `incomplete` says what was not searched and how to finish. An empty match list proves absence only when `scan_complete` is true. Binary files no longer make a scan incomplete. The ripgrep path no longer stops at `WORKSPACE_GREP_MAX_FILES` or re-reads every file to classify it; that cap applies only to the Python walker. A ripgrep timeout is still an `incomplete_scan` error.
+- The `memory` extra requires MemPalace 3.11. Installs take 3.11 bug-fix releases but no longer resolve 3.12 or later.
+- Memory uses MemPalace's default `minilm` embedder. `embeddinggemma-300m` was not a MemPalace model name; older builds filed those palaces with MiniLM. Startup rewrites that name to `minilm` and leaves the existing index in place.
+- An unpriced model logs `unknown model for pricing lookup` once per process instead of on every usage event.
+- MCP servers marked `autoConnect` connect in parallel. Boot returns after reading `mcp.json` and finishes those connects in the background; the first turn waits only for the time still left and still sees the tools. `MCP_STRICT_LOAD` still waits for them and fails startup on a connect error.
+- The gateway opens the model provider's HTTP connection at startup with a models-list request and keeps that socket for 120 seconds, so the first turn does not wait on a cold connection.
+- The harness prompt tells the model to issue independent `read_file` calls in one response instead of one file per turn. `grep` says to read the matching paths together once they are known.
+- OpenAI-compatible token counting loads the tiktoken `cl100k_base` encoding when the provider module is imported, so a turn that counts with that encoding pays the warm count instead of the cold load.
+- A thread past about 70% of its context window summarizes in the background. The turn that crosses the summary bar applies that summary instead of waiting on the summarizer, and falls back to summarizing inline when the summary is missing or the covered history changed.
+
+### Fixed
+
+- Jailed headless Chromium can allocate its WebGL backbuffer again. Chrome 145 needs the IOSurface user client, and SwiftShader has to be requested explicitly.
+- OpenAI-compatible providers still import when that tiktoken encoding file cannot be read at startup. Token counting raises the same error on the turn that needs the encoder, and a later successful read is cached as usual.
+- Cancelling gateway, harness, or subagent startup while an `autoConnect` server is still connecting closes that server instead of leaving its process behind.
+- `mempalace search` from `run_command` no longer fails with `Operation not permitted (os error 1)` on a palace using the `minilm` embedder. The command jail now lets `mempalace`, and only `mempalace`, read Chroma's installed MiniLM model under `~/.cache/chroma/onnx_models`.
+
+## [cli v0.11.0] - 2026-10-22
+
+### Added
+
+- `monkeybot new --template coding` scaffolds an agent with a coding `AGENT.md`, a toolchain command allowlist (including yarn, with `rm` denied inside `bash -c`), ask-before-push permissions that also match chained commands and `bash -c`, and `coding.verification_gate` turned on.
+- `monkeybot mcp-login` signs in to one remote MCP server in the browser and writes the token file core reuses.
+- New scaffolds list `./tests/` and `./src/` in `command_allowlist.yaml`. `refresh` does not re-add them to an allowlist you already configured.
+
+### Changed
+
+- Requires `monkeybot[cli]>=3.10.0,<4`. `monkeybot mcp-login` imports the OAuth flow added in core 3.10.0.
+
+## [core v3.10.0] - 2026-10-22
+
+### Added
+
+- Coding mode for agents that work in a repository. It adds an editing & verification protocol to the prompt, puts `AGENTS.md` / `CLAUDE.md` and a short repo overview in the cached prompt prefix, reports git branch and dirty files each turn, refuses edits to files the model has not read (`read_before_write`) or that changed since (`stale_read`), and — with `coding.verification_gate` — refuses a final answer that follows edits no test or lint run has passed since. See `docs/features.md` §22.
+- Hooks: `PRE_FINAL_ANSWER` (a hook may refuse a final answer once the tools are done; `BEFORE_PROVIDER_REQUEST` may hold the text until then) and `HISTORY_COMPACTED` (awaited after history is summarized). A tool failing on the same file repeatedly trips doom-loop recovery even when its other arguments, or the path's spelling, change.
+- New `list_dir` tool. `grep` gains `context`, `files_only` and `respect_gitignore`; `glob` takes `files_only` and no longer walks `node_modules`, `.git`, `build` and similar. `replace_in_file` and `apply_patch` return the edited `line` and a numbered `snippet`. Skills appear in the prompt as `name — description`.
+- Live eval suites `coding` and `coding_hard` (`evals/suites/`) over fixture repos, with workspace-checked assertions (`workspace_command_passes`, `workspace_file_contains`, `workspace_unchanged`, `final_text_regex`, `verified_before_final`), seeded-bug overlays, and `python -m evals.trials` to run a suite repeatedly and compare configurations. The eval runner answers `ask_user` prompts so a run cannot hang waiting for a human.
+- Remote MCP servers can sign in with browser OAuth. Tokens are stored per server and reused on later connects; a failed refresh is reported as an auth error.
+
+### Changed
+
+- Coding mode is always on for every agent. `coding.enabled` is retired: a leftover `coding: {enabled: ...}` is ignored with a warning. Every agent now gets the editing & verification protocol, the read-before-write ledger (`read_before_write` / `stale_read` refusals), project instructions and repo overview in the cached prompt prefix, and git state in runtime notes. `coding.verification_gate.enabled` stays opt-in.
+- `glob` returns files only by default; pass `files_only: false` to also list directories. `bash -c` scripts are screened command by command against `deny_patterns`.
+
+### Fixed
+
+- `run_command` output over the spill threshold no longer hides `exit_code`, `stderr` and the end of the output behind a truncated JSON prefix. The result stays valid JSON with head/tail excerpts and the full streams at `output_path`.
+- `run_command` accepts `./tests/` and `./src/` path arguments (relative or workspace-absolute) under the built-in defaults, so `pytest ./tests` is no longer rejected. A configured allowlist is not widened.
+- `deny_patterns` that anchor on the start of a command (`^rm\s+-rf`, `^curl`, `^sudo`) now also apply to commands inside `bash -c "…"`. A `bash -c` script that cannot be screened is rejected instead of run.
+- The progress tracker's `write_without_read` / `rewrite_churn` signals never fired for `replace_in_file` (it tracked a tool name that does not exist).
+- `apply_patch` rejects a hunk whose old lines match several places instead of silently editing the first, rejects hunk lines with no valid prefix instead of dropping them, and honors `*** End of File`.
+- Subagent personas' `model` and `vertex_location` are used by `task` instead of the parent's model.
+- A provider call that fails with an empty message (for example an `httpx.ReadTimeout`) now reports `Provider request failed (<ExceptionType>)` instead of a blank error.
+- Over-budget tool text keeps its tail (70% head / 30% tail) instead of only its head.
+
+## [cli v0.10.0] - 2026-10-18
+
+### Added
+
+- `monkeybot doctor` reports `model.reasoning_effort`, including when a non-Claude Bedrock model will not receive it.
+- `fireworks` is a scaffold provider choice and validates with `FIREWORKS_API_KEY`.
+
+### Changed
+
+- Requires `monkeybot[cli]>=3.9.0,<4`. Doctor imports the reasoning-effort helpers added in core 3.9.0.
+
+## [core v3.9.0] - 2026-10-18
+
+### Added
+
+- `fireworks` model provider (`monkeybot[fireworks]`) for Fireworks AI's OpenAI-compatible API. Set `model.provider: fireworks` and `FIREWORKS_API_KEY`; `FIREWORKS_BASE_URL` overrides the default `https://api.fireworks.ai/inference/v1`. Model ids are passed through unchanged, e.g. `accounts/fireworks/models/llama-v3p3-70b-instruct`.
+- `model.reasoning_effort` sends an effort level on the provider's wire field. It wins over `thinking_budget` where the provider accepts it. `none` turns thinking off. A level the API rejects is omitted on later turns. Gemini only sends levels its SDK knows; other values stay on `thinking_budget`.
+
+### Fixed
+
+- Token-pressure compaction judges viability on raw stored rows and compacts that history, not the provider-facing view.
+- A turn that fails during setup still persists the user prompt.
+- Jailed commands can launch headless Chrome. Toolchain caches stay in the workspace and are not injected into direct mempalace calls.
+
+### Changed
+
+- Provider SDK clients are reused per endpoint and closed when the process shuts down.
+- PDF text extracts are sized by the read window, spills are reused, and markdown uploads are normalized.
+
+## [cli v0.9.0] - 2026-10-07
+
+### Added
+
+- `monkeybot trace list` and `monkeybot trace digest` turn a session transcript into a resolved timeline, with each subagent run shown under the `task` call that started it. In chat, `/export-trace` copies the whole session directory. The `mb-retro` skill proposes environment fixes from one hard session and does not edit anything until you pick a candidate.
+
+### Changed
+
+- Requires `monkeybot[cli]>=3.8.0,<4`. `monkeybot trace` imports the transcript reader added in core 3.8.0.
+
+## [core v3.8.0] - 2026-10-07
+
+### Added
+
+- Stored chat history can branch. Rows keep a stable `row_id`. `POST /sessions/{id}/branches` edits, regenerates, rewinds, or restores from an anchor; truncate shortens the active thread in place; fork copies a prefix into a new session. A summarized prefix stays read-only unless the cut keeps that summary. Queued follow-ups drain onto the branch that becomes active. Goal ledger and tracker state carry across a rewrite. Older databases rebuild `session_branches` on startup, including Postgres.
+- Session transcripts record harness guard hits as `HarnessIntervention` (not sent on SSE) and write each subagent run under the parent session's `subagents/` directory when `runtime.transcript_enabled` is on.
+
+### Fixed
+
+- Transcript prompt diffs no longer drop changed lines that start with `--` or `++`, such as a removed `---` rule. Diffs already written that way are flagged as `text_error: diff_mismatch` when read instead of being rebuilt wrong.
+- A background `run_command` in the sandbox keeps running after launch returns.
+
+### Removed
+
+- The workspace knowledge index and the `search` tool. Agents explore the workspace with `grep` and `glob`, then `read_file`. Memory search, web search, and browser DOM indexing are unchanged.
+- The `knowledge-ast` and `knowledge-media` extras. Installs that still request them get an unknown-extra warning; drop them from agent deps.
+- `numpy` is no longer a core dependency.
+
+### Changed
+
+- A leftover `knowledge:` section in `monkeybot.yaml` is warned once and ignored. Old index files (`index.sqlite`, `.monkeybot/knowledge/`) are no longer read and can be deleted.
+- The `Evidence:` path guard moved to `core/hooks/evidence_guard.py` and is always registered by the gateway. Before, it ran only when `knowledge.enabled` was on.
+
+## [core v3.7.0] - 2026-09-30
+
+### Added
+
+- `run_command` can start a long command in the background and return `job_id` and `log_path` immediately. `await_command` pages its output until it exits, and `kill_command` stops it, on the local terminal and in the OpenSandbox executor. A turn cannot finish while a job is still running; leftover jobs are killed when the turn ends. The sandbox renews its lease while a job runs, up to the job time ceiling.
+
+## [browser v0.8.1] - 2026-09-28
+
+### Fixed
+
+- The per-chat browser IPC router honors browser-harness 0.1.13's response timeout, so browser tools can drive the page again.
+
+## [browser v0.8.0] - 2026-09-27
+
+### Added
+
+- Each Spaces chat gets its own browser daemon, tab registry, and lock, so simultaneous chats no longer restart each other or drop tab aliases. Local Chrome and AgentCore stay on one shared browser. An idle daemon stops after 15 minutes and keeps that chat's tab aliases for the next call.
+- The per-chat tab cap is 10. When Spaces refuses a tab because the app-wide live-tab cap is full, the tool returns `tab_limit_reached` with `"scope": "app"` instead of this chat's limit.
+
+## [core v3.6.1] - 2026-09-26
+
+### Fixed
+
+- `run_command`'s macOS jail can launch onefile binaries that live under the home directory. Bundled `yt-dlp` needs to read its own executable and create a SysV semaphore; both were denied, so `/watch-video` died before any download.
+- `run_command` can read an installed on-device Whisper model under the home directory, so `/watch-video` can transcribe with it.
+
+## [cli v0.8.0] - 2026-09-21
+
+#### Added
+
+- `monkeybot chat` prompts for an `ask_user` question and posts the reply to the gateway.
+
+## [core v3.6.0] - 2026-09-21
+
+#### Added
+
+- `ask_user` asks the user a question, with an optional list of two to six choices, and waits for the posted answer before the tool returns.
+
+## [core v3.5.0] - 2026-09-20
+
+### Added
+
+- Native durable goals beside scheduled loops (`create_goal` / `update_goal`, plus `/goals` pause/resume/stop). Continuations are scheduled automatically until the goal completes or is stopped.
+- `FileBlock` SSE for generated documents (path/filename/mime — clients load from disk). Workspace open/export stays inside the workspace and still denies nested credential directories.
+- HTML (`text/html`) uploads for Files preview, and `text/plain` attachments inlined at resolve.
+- Promote a queued follow-up into the live turn (`POST /sessions/{id}/queue/{request_id}/steer`) or drop it (`DELETE`) so it never drains.
+- Verifier: request-scoped mailbox, sticky nudge until the tracker recovers, nudge armed on judge deposit, concurrent session-bound `ProviderJudge` jobs with scoped budgets and fencing, and staged reload so live workers stay intact.
+
+### Changed
+
+- `verifier.enabled: true` turns on omitted nested `ledger` / `tracker` flags. Omitted `judge.enabled` turns on only when the tracker is on. Explicit `enabled: false` still opts a nested section out.
+- Omitted `verifier.ledger.model` / `verifier.judge.model` inherit the agent model (`model.name` / `MODEL_NAME`, then `gemini-2.5-flash`). The live judge worker is session-bound `ProviderJudge`.
+
+### Fixed
+
+- Provider requests that exceed the multimodal byte budget drop media rather than sending an oversized body; remaining oversize fails closed. In-flight media is frozen on abort.
+- Promoted follow-ups no longer vanish if the turn ends before they inject — they restore to the front of the follow-up queue.
+
+### Notes
+
+- Existing configs that set only `verifier.enabled: true` (or `enabled: true` plus `ledger.enabled: true`) now also get the tracker, and the judge if the tracker stays on. Opt out with `tracker.enabled: false` / `judge.enabled: false`.
+
+## [cli v0.7.0] - 2026-09-20
+
+### Added
+
+- New agents install a packaged `skills/goal/SKILL.md` for explicit `/goal` invocations. `monkeybot refresh` adds it when missing.
+
+### Changed
+
+- Example YAML documents verifier nested enable-flag inheritance and optional model inherit.
+
+## [browser v0.7.2] - 2026-09-13
+
+#### Fixed
+
+- Reuse the focused `about:blank` tab when opening a URL so agent `Target.createTarget` does not stack a leftover New tab next to the first real page.
+
+## [browser v0.7.1] - 2026-09-12
+
+#### Fixed
+
+- Empty in-app browsers report `no page target` so `browser_act` / `run_playbook` can `goto` instead of aborting. Stale sessions still fail closed when other tabs exist.
+
+## [core v3.4.0] - 2026-09-12
+
+### Added
+
+- A leading `/slug` in the user turn pins that installed skill for the turn (`## Invoked skill`) without rewriting persisted chat text.
+
+## [browser v0.7.0] - 2026-09-10
+
+#### Added
+
+- Announces the chat it is acting for to the Spaces in-app bridge (`Monkeybot.setChatScope`) so tabs stay attached to their chat; silently no-op on older apps.
+
+#### Fixed
+
+- Chat-switch tab drop now fires on real tool calls (`browser_harness()` reuse no longer forgets the last scoped chat).
+
+## [core v3.3.0] - 2026-09-11
+
+### Breaking
+
+- `run_command` now runs inside a deny-by-default OS filesystem jail (macOS `sandbox-exec`; Linux mount-namespace, unvalidated on a real host as part of this change) on top of the existing binary/path allowlist. The user's home directory is denied by default; the workspace, artifacts, memory palace, and OS temp dirs stay read+write, and skills/the interpreter prefix/granted folders stay read-only, including when they sit inside the denied home directory (the normal case for a desktop app). This closes a real gap: the old argv-string path screen never caught indirect path expressions a shell or interpreter builds at runtime (`bash -c 'cp "$HOME/Desktop/x" .'`, or a Python `os.path.expanduser(...)` call), so a command that depended on reading/writing somewhere under `$HOME` outside the workspace — by accident or on purpose — will now fail where it previously succeeded. `git` keeps working via a narrow, explicit `~/.gitconfig`/`~/.config/git/ignore` read carve-out (needed even for `--version`); `gh` does not — its own auth config is credential-adjacent and is not carved out, matching the credential-path denylist already established for `computer_*` tools. If the OS jail mechanism itself is unavailable on a host (older kernels without unprivileged user namespaces, some hardened/CI Linux configs), `run_command` falls back to running **unconfined** (logged once, not per call) rather than refusing every command — a deliberate difference from the existing memory-off hide mechanism, which still fails closed, since this is default-on hardening for every deployment rather than a narrow, deliberate opt-out.
+
+### Added
+
+- MCP tool calls now carry `_meta.monkeybot` (`thread_id`, `request_id`, `run_id`) so servers can attribute work to a chat. Requires `mcp>=1.27.1` so `ClientSession.call_tool(meta=)` is always available.
+- **Command grants:** an unlisted `run_command` binary now surfaces a "Needs your OK" approval card (`Decision.grant_key`/`grant_kind` on `CommandTierInspector`) instead of silently falling through to a hard `SecurityError` at the executor. "Allow once" covers the rest of the turn; "Always allow" writes a durable rule to a new home-level store, `grants.json` (`core/tools/grant_store.py`), shared by every agent on the machine — deliberately separate from the per-agent, `computer_*`-only `approvals.json`. Same on-disk contract (JSON, `0600`, atomic replace, cross-process exclusive-create locking matched with the Electron side).
+- **Folder read grants:** `read_file`/`load_file`/`glob`/`grep` on an absolute path outside the workspace now ask via a new `PathGrantInspector` rather than rejecting outright — denying credential paths and anything outside `$HOME` hard, never promotable. An approved folder is read in place through `WorkspaceFileService.extra_read_roots` (symlink-escape-protected, read-only — never widens what `write_file`/`replace_in_file` can touch); the same granted folders feed the `run_command` jail's read-only set so the shell tool and the file tools agree on what's reachable. Fixes the failure mode where the model, unable to read a file outside its workspace and told only "use a relative path," would narrate copying the file into the workspace to route around the boundary — tool descriptions, the harness prompt, and the `workspace_error_envelope` hint for this case now say to ask for access instead, explicitly calling relocating-to-route-around-the-boundary a policy violation.
+- Settings → Privacy & access gained **Allowed commands** and **Folder access** sections listing/revoking these new grants, alongside the existing per-agent `computer_*` rules.
+
+## [browser v0.6.0] - 2026-09-07
+
+#### Added
+
+- `browser_login` now returns fail-closed errors from the Spaces sealed-login path, scopes grants and errors per run (`MONKEYBOT_RUN_ID` / `MONKEYBOT_RUN_LABEL`), and surfaces TOTP outcome (`mfa`: `none` / `completed` / `needed`) plus injection mode (`mode`: `keystroke` / `network`).
+- `browser_passkey` requests a Spaces-saved passkey with the same allowlisted error surface as `browser_login`. Live passkey sites have not been verified yet.
+
+#### Fixed
+
+- Credential-broker JSON 413 responses fail closed instead of leaking a body, and thinking text is redacted on that path. Tool descriptions are `cleandoc`'d so the golden surface matches CI.
+
+## [core v3.2.0] - 2026-09-07
+
+#### Added
+
+- Opt-in background verifier (`verifier:` in YAML, defaults off, no env mapping). A SQLite goal ledger plus an off-loop classifier record the user's intent; an observe-only progress tracker emits `VerifierVerdict` events; verdicts persist as pinned `verifierVerdict` history rows through compaction. When `max_severity` allows it, the ladder can nudge on the next system extra, replan by emptying tools for one inner turn, or block mutating tools while `parallel_safe` reads still run. Firestore/Postgres have no ledger (fail closed). See `docs/verifier-agent-design.md`.
+- Credential-egress detection: new assistant text and tool results are scanned against Spaces' `/json/scan` before they reach the LLM, with a separate scan of outbound tool arguments (terminal, file write, browser navigation/input, `web_*`) and a local-SQLite-only trace-value scan. A hit is redacted in place; a routine turn ends visibly and an interactive chat continues with the secret withheld. User-authored text is never scanned. Emits `CredentialEgressBlocked`.
+
+## [core v3.1.0] - 2026-09-05
+
+### Breaking
+
+- `context_curation` is retired. The section no longer maps to env or trims MemPalace wake-up lines. Leftover YAML still loads and logs one warning per process; `CONTEXT_CURATION_*` / `MEMORY_INDEX_CAP` process env is unused. Wake-up size is whatever MemPalace L0+L1 returns; `model.context_window` still only bounds history summarization. Subagents now include the same wake-up block as the parent (they previously received none of it).
+- `model.provider`, `model.name`, `model.temperature`, `model.max_tokens`, `model.thinking_budget`, `model.context_window`, `model.summarization_model`, `model.max_turns`, and `model.cache_retention` are YAML-only. Process env `MODEL_PROVIDER`, `MODEL_NAME`, `MODEL_TEMPERATURE`, `MODEL_MAX_TOKENS`, `MODEL_THINKING_BUDGET`, `MODEL_CONTEXT_WINDOW`, `CONTEXT_SUMMARIZATION_MODEL`, `MAX_TURNS`, and `MODEL_CACHE_RETENTION` are ignored (a warning is logged once per process). If leftover `MODEL_PROVIDER` is set and `monkeybot.yaml` has no `model.provider`, startup fails instead of silently defaulting to `google_vertexai` / `gemini-2.5-flash`. Set them under `model:` in `monkeybot.yaml`. Credentials (`GEMINI_API_KEY`, `NVIDIA_API_KEY`, …) stay in `.env`.
+
+### Added
+
+- Local Ollama prefix-cache knobs: `ollama-local` sends `keep_alive` (default 24h, `model.keep_alive`) and optional pinned `num_ctx` (`model.num_ctx`) via OpenAI-compat `extra_body`. YAML-only — not mapped from the runtime env. `model.context_window` is never mapped to `num_ctx`. See `docs/ollama-local.md` and `examples/ollama/PrefixStable.Modelfile`.
+
+### Fixed
+
+- An image inside a tool result (e.g. `load_file`) now reaches OpenAI-compatible models (OpenAI, Ollama, NVIDIA, HuggingFace, OpenRouter) as a real `image_url` promoted into a synthetic user turn after the tool row, instead of a text placeholder telling the model to guess at content it never saw. Anthropic-family, Bedrock, and Gemini already carried this media natively and are unaffected. Also fixes Gemini replaying a media-only tool result as an empty `functionResponse`, and fixes OpenAI-compat prompt-token counting tokenizing an image's base64 data URL as JSON text (a 1MB image previously counted as ~340K tokens and could trigger spurious compaction).
+- Subagent timeout/cancel now walks and kills the full process tree (including nested `run_command` sessions that use their own `start_new_session` process groups), not only the subagent leader's session. `process_group_id` returns `None` when the PID is gone instead of treating a recycled PID as a process group. The tree walk's non-`/proc` fallback (macOS) now uses `pgrep -P` instead of an invalid BSD `ps -P` invocation that silently returned no children. `stop_subagent_process` `killpg`s the spawn-time `pgid` even after the leader has been reaped, and skips the tree walk in that case so a recycled leader PID cannot be used as a `killpg` target.
+- Scheduled loops: a single malformed record — e.g. `interval_ms <= 0` from legacy/hand-edited data — is skipped and logged on Firestore, SQLite, and Postgres `get`/`list_all`/`list_due` instead of raising out of the mapper and stalling the scheduler (or 500ing the loops API).
+- Progressive MCP: harness catalog + `enable_mcp` schema no longer mention `mcp.json`, which sent models to `read_file` a control-plane file outside the workspace. Catalog names are now an `enable_mcp` enum; the tool is omitted when the catalog is empty.
+
+## [browser v0.5.0] - 2026-09-05
+
+### Added
+
+- Opt-in per-tool timing via `BROWSER_MCP_PERF=1` (JSONL to `BROWSER_MCP_PERF_LOG` or `<workspace>/browser/perf/tools.jsonl`). Never logs tool arguments. `scripts/perf_bench.py` records the Phase 0 baseline against static fixtures. See [browser-mcp-perf-baseline.md](docs/browser-mcp-perf-baseline.md).
+- The DOM driver is registered once per tab (`Page.addScriptToEvaluateOnNewDocument` / Playwright `add_init_script`) so `browser_get_elements` after navigation is one harness call. `browser_input_by_index` gains `mode` (`auto`/`keys`/`fast`) and returns `mode_used`; default override `BROWSER_MCP_FILL_MODE`. `browser_goto(url, new_tab=False)` reuses the current tab via `goto_url` and an in-page load/settle wait. `browser_click_by_index` adds `warning` when the target is covered by another element.
+- Tab registry with aliases (`t1`, `t2`, …), `tab=` on interaction tools (omitted = focused tab), `browser_open_tab` / `browser_close_tab` / `browser_read_tabs`, enriched `browser_tabs` (`{ok, focused, tabs}` instead of a raw list), alias-aware `browser_switch_tab`, five-tab cap (`BROWSER_MCP_MAX_TABS`, user chooses what to drop), and serialized tool execution. Reads never move focus; actions do. `browser_stop` closes agent-opened tabs.
+- `browser_screenshot` defaults to JPEG (`max_dim=1200`, `quality=60`) and returns `bytes` + `format`. `annotate=True` draws current `get_elements` index labels so the next action can still use `browser_click_by_index`. PNG remains available via `format="png"`. Inline MCP images (7b) are not included.
+- `browser_wait_for` waits with one in-page `MutationObserver` (chunked at 4s to stay under the harness IPC timeout) instead of polling `wait_for_element`. `browser_wait_idle` still uses network idle on the focused tab, then a DOM settle; `ok`/`idle` stay the network result and the response adds `quiet`/`navigated`.
+- `browser_get_elements` defaults to the viewport (`BROWSER_MCP_VIEWPORT_DEFAULT`), filters with `kind` / `contains` / `max_elements=150`, and returns `truncated` + `below_viewport`. Indices stay valid until navigation. `observe="diff"` diffs against the per-tab cached tree. New `browser_get_text` for readable body copy.
+- Action tools (`click`/`input`/`select`/`fill`/`press`/`scroll`/`switch_tab`) settle then return `{action, page, observation}` (diff by default, `BROWSER_MCP_OBSERVE_DEFAULT`; `observe="none"` keeps the legacy shape). `browser_goto` and focused `browser_open_tab` return a full observation. Timing: `BROWSER_MCP_SETTLE_MS` / `BROWSER_MCP_QUIET_MS`. Legacy top-level keys (`clicked`, `index`, `tagName`, `selected`) stay for this release.
+- `browser_act` runs up to 25 sequential steps in one turn (`fill_form` is a step, not a separate tool); `browser_click_text` clicks by visible text; `browser_extract` scrapes structured rows. Shared `do_*` helpers back both the single tools and the batch executor.
+- Optional `playbook` YAML fences in host markdown are executable via `browser_run_playbook`. `browser_list_playbooks` / `browser_goto` list `flows`. `browser_write_playbook` validates fences before save. Timeout: `BROWSER_MCP_PLAYBOOK_TIMEOUT_S` (default 120). Secrets are never flow params — use `{do: login, expected_origin}`.
+
+## [cli v0.6.0] - 2026-09-05
+
+### Added
+
+- `doctor` warns on local Ollama `*-mlx` tags, default thinking on known reasoning tags, and huge `num_ctx`, and fails on unparseable/`<1` `num_ctx`. See `docs/ollama-local.md`.
+
+### Changed
+
+- New-agent browser skill documents `fill_form` as a `browser_act` / playbook step.
+- Example YAML documents YAML-only `model.*` knobs and drops retired `context_curation`.
+- Declares `monkeybot[cli]>=3.1.0,<4` and `monkeybot-browser-mcp>=0.5.0,<1` so a global CLI install pulls this train.
+
+## [browser v0.4.0] - 2026-08-29
+
+### Added
+
+- `browser_login`: sign in with a Spaces-saved password without exposing the credential. Returns the `origin` it acted on and accepts `expected_origin`, so a login cannot silently land on a tab other than the one the agent is driving. In-app CDP uses a tokenized WebSocket URL so a 403 is not misreported as Chrome's Allow-remote-debugging popup.
+
+### Fixed
+
+- Scrubs `?token=` values from every browser tool error rather than only daemon startup, so the in-app CDP token cannot reach the agent transcript through a mid-session harness failure.
+
+## [cli v0.5.1] - 2026-08-28
+
+### Changed
+
+- CLI extras catalog / `monkeybot new` provider menu lists `ollama-cloud` and `ollama-local` instead of a single `ollama` row. `--with ollama` and `--provider ollama` still work.
+
+## [core v3.0.4] - 2026-08-28
+
+### Added
+
+- Explicit `ollama-cloud` and `ollama-local` provider ids so Cloud always hits `https://ollama.com` even when a leftover local `OLLAMA_BASE_URL` is set. Legacy `ollama` still auto-routes from env.
+
+## [core v3.0.3] - 2026-08-23
+
+### Added
+
+- Local computer control: nine opt-in, macOS-only `computer_*` tools (`computer/`) let the agent open/reveal files and folders, launch apps, open URLs, read/write the clipboard, and list/find/move/trash files under the user's home directory. Off by default (`computer.enabled: false` / `MONKEYBOT_COMPUTER_TOOLS`); intended for the Monkeybot desktop app, never a server deployment. Every call asks for approval by default via a built-in ruleset baseline (not `permissions.yaml`, which is fail-open); "Always allow" is scoped to the exact `(tool, resource)` approved and persists durably to `monkeybot_config/approvals.json` (a new machine-written file — never hand-edit). Hard security limits (home-directory confinement, credential-path denylist, exec-surface refusal on `open`, trash-not-delete) live in the tool bodies and cannot be bypassed by permission rules. See `docs/features.md` §22.
+- `permissions.yaml`'s `tool-confirmations` approval now supports a durable `persist` hook (`remember_always_approval(..., persist=...)`) in addition to the existing in-session `SessionApprovals` cache; `resource_for_call` gained `url`/`app` argument lookups for readable permission resource strings on tools with no `path` arg.
+
+### Fixed
+
+- Anthropic SDK 1.0 removed `temperature` / `top_p` / `top_k` from `messages.stream()`. Filter stream kwargs to the callable signature and retry `TypeError: unexpected keyword argument` so Claude/Bedrock streams no longer die before the request.
+- Stop during a tool confirmation sets the turn cancel Event in `POST /cancel` (and on realtime interrupt) before pending futures are cancelled, so completed tool results settle into history instead of racing a 50ms poller. Session DELETE and websocket teardown leave the Event unset and propagate cancellation. Spill writes refuse an uncontained `_` symlink fallback; transcript and attachment dirs reuse a safe pre-sanitization folder when it still exists on disk. Attachment reads also reject symlinked attachment ids that resolve outside the workspace.
+
+## [core v3.0.2] - 2026-08-18
+
+### Fixed
+
+- Compute-only OpenSandbox (`SANDBOX_SHARED_FILESYSTEM=false`) no longer rejects every `run_command` when the harness passes the default workspace-root cwd. Nested workspace cwd and workspace/skills path args are still refused.
+
+## [core v3.0.1] - 2026-08-18
+
+### Fixed
+
+- Host `run_command` no longer fail-closes every command when filesystem isolation is unavailable and none of the memory hidden paths exist on disk (typical in nested Linux containers with memory off). Isolation is still required — and the command still refused — when at least one palace path is present.
+
+## [core v3.0.0] - 2026-08-17
+
+### Breaking
+
+- Note-based memory (INDEX.md, curator, `search_memory` / `edit_memory` / `forget`) is replaced by per-agent MemPalace with a durable outbox on SQLite, Postgres, and Firestore. Capture can be turned off with `memory.enabled: false` or `MONKEYBOT_MEMORY_HOOK_ENABLED=0`. Object-store palace URIs (`gcs://`, `s3://`) are not supported; use `local://`. MemPalace itself is the optional `monkeybot[memory]` extra.
+- `subagents:` as a bare list of personas is no longer supported; wrap personas under `subagents.personas` in `monkeybot.yaml`. `SUBAGENT_TIMEOUT_SEC`, `SUBAGENT_MAX_TURNS`, and `MONKEYBOT_SUBAGENT_AGENT_MD` environment variable overrides are removed — set `subagents.timeout_sec`, `subagents.max_turns`, and per-persona `agent_md` in `monkeybot.yaml` instead. Top-level `subagents.agent_md` is also removed.
+
+### Added
+
+- MemPalace outbox now persists on Postgres and Firestore (same table/document shape as SQLite), with replica `palace_id` claim partitioning. Replicated deployments must share a lock-capable palace volume.
+- Knowledge indexing follows document structure instead of fixed line windows: markdown headings, code definitions (tree-sitter via the optional `knowledge-ast` extra, brace/indent heuristic otherwise), and JSON/YAML/TOML top-level keys become chunk boundaries.
+- Embeddings run on NVIDIA, OpenAI, any OpenAI-compatible endpoint, Voyage, or Gemini via `knowledge.embeddings.provider`. Misconfigured or unavailable providers degrade to keyword + graph search rather than failing the turn.
+- PDF, DOCX, and image files are indexed with the `knowledge-media` extra. Images use `knowledge.captions` (`off` / `path` / `llm`); DOCX indexing covers tables as well as paragraphs.
+- Subagents search the parent workspace index read-only, and a second gateway attempting to write the same index is refused.
+- Soft spill and unified `read_file` char budgets derive from `model.context_window`: large tool results always land on disk with a large inline body when headroom allows; `read_file` returns `next_offset` and never lies about `end_line`.
+- When memory is off, host `run_command` children cannot see palace files (Linux user+mount namespaces or macOS `sandbox-exec`). If isolation cannot be established, the command is refused. OpenSandbox does not mount the palace. `/tmp` and `/var/folders` are no longer implicitly allowlisted path prefixes.
+
+### Fixed
+
+- Firestore scheduled-loop `defer_tick` and `release_stale_claims` now re-check claim ownership / lease freshness inside a transaction (matching SQL `WHERE` guards), so a stale worker cannot clear another worker's reclaimed tick and a renewed heartbeat cannot be wiped mid-release.
+- Inline `task` subagent timeout/cancel kills the process group (not only the direct child), matching the worker-pool path so nested shell descendants do not keep running after Stop. The inline subagent is detached from the parent process group (`start_new_session`), so a parent SIGKILL/crash no longer tears it down automatically — cleanup relies on timeout/cancel paths. Inline `task` has no `subagent.pid` reap path (unlike the worker pool); orphans after a hard parent crash are accepted on that path.
+- Stop during a tool confirmation now settles completed tool results into history (and synthesizes cancel envelopes for the rest) instead of escaping before abort settlement; the realtime confirm path does the same. Cancel after a finished provider stream also persists already-shown assistant text so follow-ups match what the user saw, and settles any finalized tool calls with cancel envelopes.
+- SQLite `history.reset` (compaction / load-max truncate) runs delete+reinsert in one transaction, matching Postgres, so a crash mid-reset cannot wipe or partially rewrite a thread.
+- Tool spill paths sanitize client `session_id` / `thread_id` components and refuse to write or delete outside `.monkeybot/spill`; `POST /sessions` rejects path-traversal session ids; session DELETE quiesces the active turn before removing spill dirs. The same path-component sanitizer also applies to transcript and attachment directories, so legacy ids containing glob metacharacters map to a sanitized on-disk folder (reads still find a pre-sanitization folder when it exists).
+- Streamable HTTP MCP connects accept both 2-tuple and 3-tuple transport yields from the MCP Python SDK.
+- Stop mid-reply now cancels the in-flight provider token stream (instead of waiting for the full LLM call) and persists any already-streamed assistant text to history so follow-up turns keep matching what the user saw.
+- Chunking improvements now reach existing workspaces: a chunker version bump re-chunks indexed files even when their modification time never changed, so upgrades no longer require deleting `.monkeybot/knowledge/`.
+- Vector search scores only vectors from the active embedding model. Switching provider or `dimensions` purges the incomparable rows at startup and re-embeds them, instead of blending two models into one similarity ranking.
+- The knowledge index writer lock is claimed atomically, so two gateways starting at the same moment can no longer both believe they own the index.
+- Embedding requests carry a per-request timeout, so one slow endpoint cannot stall an indexing pass; cached vector matrices are bounded by a memory budget with least-recently-used eviction.
+- PDF extraction closes its file handle (previously leaked a descriptor per file on large scans), the code chunker no longer splits mid-function when a docstring contains an unbalanced brace, and `knowledge.chunk_overlap_ratio` is honored for markdown, code, and structured files.
+- `read_file` no longer applies a post-hoc 32k char chop after line selection (which made `end_line` lie and caused the model to skip unread lines when paging).
+- `read_file` reports `truncated: false` and omits `next_offset` when a read reaches the end of the file, instead of marking every complete read truncated and pointing past EOF. A line too long for the whole char budget is now marked inline where it was cut.
+- Tool results too large to inline as-is are shaped into still-valid JSON (with `… (+N more items)` markers) rather than inlined as a raw, unparseable JSON prefix.
+- Context summarization sizes its per-result cap from the active model's context window rather than a hardcoded 200k window.
+
+### Changed
+
+- `mcp` is pinned to `>=1.0.0,<2` until Streamable HTTP can construct an `httpx2.AsyncClient` for MCP SDK 2.x (see #190).
+- Subagent defaults and named personas are now configured under a single `subagents:` YAML mapping (`subagents.timeout_sec`, `subagents.max_turns`, `subagents.vertex_google_search`, `subagents.personas`), replacing the separate `subagent:` defaults block and bare-list `subagents:` personas. Persona prompts live only on `subagents.personas[].agent_md`; tasks without a `subagent_type` inherit the parent `paths.agent_md`.
+- Spill sizing is window-derived (soft spill). `tools.spill_min_chars` / `tools.spill_read_max_lines` / `tools.read_default_lines` are retired (warned, ignored). `tools.read_max_lines` is YAML-only (env overrides removed). `read_file` defaults to 2000 lines when `limit` is omitted; pass `limit` to request more. Large ordinary reads can return more content than the old flat 32k cap.
+
+## [browser v0.3.0] - 2026-08-17
+
+### Added
+
+- AWS Bedrock AgentCore Browser backend via the optional `agentcore` extra (`bedrock-agentcore`, Playwright).
+- Prefer a Monkeyapp in-app CDP endpoint over desktop Chrome or a stale `BROWSER_CDP_*` env when the in-app CDP file is present.
+
+### Changed
+
+- `mcp` is pinned to `>=1.0.0,<2` (same Streamable HTTP constraint as core; see #190).
+
+## [cli v0.5.0] - 2026-08-17
+
+### Added
+
+- `monkeybot run` / `chat` / `talk` refuse to start when the agent interpreter lacks MonkeyBot 3.x (and MemPalace when memory is enabled). A failed probe may `uv sync` an existing lock; it never rewrites `pyproject.toml`. Config-only agents with memory on get a CLI-managed cache venv holding `monkeybot[memory]` pinned to the running core, reused offline. A local monkeybot checkout can provision that runtime from source; the cache invalidates when those sources change.
+- `monkeybot chat` TUI gained Claude-Code-style interaction: `Esc` interrupts the active turn (double-tap while idle recalls your last message for editing), `Shift+Tab` cycles a client-side approval mode (`normal` / `auto-approve` / `deny-confirms` — auto-answers tool confirmation prompts only, elicitations still ask), `@` fuzzy-inserts a workspace file path, `!<command>` runs a local shell command shown in the transcript but never sent to the agent, and `?` opens a keyboard-shortcut overlay. New slash commands: `/clear` (alias of `/new`), `/model` (switches model by starting a fresh session), `/status`, `/config`.
+- `monkeybot chat -c` / `--continue` resumes the most recent session for the current agent.
+
+### Changed
+
+- `monkeybot new` no longer scaffolds capability skills into new agents.
+- Declares `monkeybot[cli]>=3.0.0,<4` so a global CLI install pulls MonkeyBot 3.x.
+
+## [cli v0.3.1] - 2026-07-28
+
+### Changed
+
+- Scaffold `monkeybot.example.yaml` documents harness-fixed `read_file` default (2000 lines), YAML-only `tools.read_max_lines`, and retired `read_default_lines` / spill knobs. `model.context_window` notes that it also drives soft-spill / read char budgets.
+
+## [core v2.2.0] - 2026-07-13
+
+### Added
+
+- Canonical agent-root layout and a read-only virtual `skills/` root.
+
+### Changed
+
+- Remote sandboxes require an explicit compute-only capability setting.
+
+### Breaking
+
+- Workspace or skills symlinks that resolve outside their respective roots are now rejected. Move their targets inside the agent's `workspace/`, `data/`, or `skills/` layout.
+
+## [browser v0.2.0] - 2026-07-13
+
+### Added
+
+- Browser MCP package release supporting the canonical agent layout.
+
+## [cli v0.3.0] - 2026-07-13
+
+### Added
+
+- Agent scaffolds now include the canonical layout, Dockerfile, and disabled browser MCP configuration.
+
+### Fixed
+
+- `monkeybot chat` no longer adopts a stale gateway on a busy port: it refuses to spawn when the port is already in use (suggesting `/bye`, stopping `monkeybot run`, or `--attach`), and `wait_for_health` rejects a `/health` 200 if the child process has already exited.
+
+## [0.2.1] - 2026-07-13
+
+### Added
+
+- First PyPI release of **monkeybot-cli** (Trusted Publishing) — install with `uv tool install monkeybot-cli`.
+
+
+## [2.1.1] - 2026-07-13
+
+### Added
+
+- Evals: `response_regex` and `response_not_contains` deterministic assertions; run files now persist per-turn prompt/response text, and `python -m evals.diff` pinpoints the exact turn behind a regression between two runs.
+- Live eval smoke workflow now also runs on every push to `main` (report-only, scorecard on the run Summary page) and on manual dispatch, in addition to the existing PR gates.
+- Live evals need only `NVIDIA_API_KEY`: the deepeval judge can now run on build.nvidia.com models (`JUDGE_PROVIDER=nvidia`) via NVIDIA's OpenAI-compatible endpoint, and CI pins agent (`meta/llama-3.3-70b-instruct`) and judge (`nvidia/llama-3.3-nemotron-super-49b-v1`) to two different free NVIDIA-hosted models. The workflow also now sets `MODEL_PROVIDER`/`MODEL_NAME` explicitly — previously it booted whatever `demo_agent`'s committed config said (ollama, which doesn't exist in CI).
+- Repo-root `monkeybot_config_example/` — full-option human-readable config templates (`.example` filenames).
+- `monkeybot new` also scaffolds `permissions.yaml`.
+- `monkeybot new` writes an agent-project `pyproject.toml` with a PyPI `monkeybot[<provider>]>=2.1.0,<3` dependency (plain `uv sync` after scaffold).
+- `monkeybot new` interactive menus (and `--with`) select additional providers/features into that same `monkeybot[…]` dep list.
+- `scripts/smoke_global_cli.sh` — local-wheel stand-in for clean-machine PyPI smoke (`uv tool install` → `new` → `uv sync` → `validate`/`doctor`/`chat`).
+- README / getting-started / onboarding skill lead with `uv tool install monkeybot-cli` (clone is contributor-only).
+- **monkeybot-cli** declares published core bound `monkeybot[cli]>=2.1.0,<3` (local clones still use `[tool.uv.sources]`).
+
+### Removed
+
+- Evals FastAPI service (`evals/main.py`, in-memory store, WebSocket fan-out, Dockerfile, `docker-compose.evals.yml`) — nothing consumed its HTTP/WS API; `python -m evals.report` is the single execution path. `google-genai` (Gemini judge dep) moved into the root `evals` extra.
+
+### Changed
+
+- `monkeybot doctor` remediation for missing extras: add `monkeybot[<extra>]` to agent deps + `uv sync` (keeps `uv sync --extra` only when the agent defines project-level optionals).
+- `fake` provider credentials treated as optional in `doctor` (smoke / no-API-key path).
+- `publish-release.yml` Trusted-Publishes to PyPI (OIDC) packages tagged in that run only — core before cli; `scripts/release.py publish` emits `packages` via `GITHUB_OUTPUT`.
+- Remove redundant CLI hatch `force-include` of `scaffold_defaults` (duplicated wheel paths and broke `uv build`).
+- Scaffold templates and `run_new` moved into **monkeybot-cli** (`monkeybot_cli.scaffold` / `scaffold_defaults`). Harness `monkeybot.scaffold` is a compatibility shim; Docker installs the CLI to scaffold at image build.
+- **monkeybot-cli** version bumped to **0.2.0**.
+
+- README integrations tables aligned with v2.0.0 shipped scope (per CHANGELOG); removed speculative "Coming Soon" items to BACKLOG.md with a short near-term roadmap.
+- Reframed public positioning: multi-cloud-capable harness with **GCP-first** docs (README, cloud deployment design, getting started, features, Pattern A guide). Clarifies this is not a universal integration catalog; documents AWS shipped paths alongside GCP examples.
+
+## [2.0.0] - 2026-07-05
+
+Major v2 rewrite: FastAPI SSE gateway, owned agent loop, pluggable storage, multi-provider support, CLI, evals, and cloud-ready deployment artifacts.
+
+### Added
+
+#### Gateway & runtime
+- **2026-05-14** — FastAPI SSE gateway (`monkeybot.gateway.sse`): `POST /sessions`, `GET /sessions/{id}/events` (SSE with `Last-Event-ID` resume), `POST /sessions/{id}/reply`, `GET /health`. SQLite-backed session bus.
+- **2026-05-14** — Owned agent loop (`monkeybot.core.runtime.loop`) with streaming provider integration, tool execution, history append, and inspector hooks. Per-turn usage recorded.
+- **2026-05-14** — Harness fixed prompt (`monkeybot.core.prompts.harness_prompt`) — non-overridable system block describing tool names, paths, MCP naming, and skill usage, appended after the bot's `AGENT.md`.
+- **2026-05-14** — Context-window safety: pre-call token counting against `MODEL_CONTEXT_WINDOW`, sync history summarization at threshold, and tool-result spill to `.monkeybot/spill/{thread_id}/{call_id}.txt` with capped in-history text + path hint.
+- **2026-05-14** — Subagents (`subagent_proto.py`, `subagent_worker.py`) — parallel `task` tool that fans out work over `asyncio.gather`; results appended in stable `call_id` order.
+- **2026-06-24** — Structured debug and error logging for the agent loop.
+- **2026-06-23** — Auto-create session on first send and background final assistant write.
+- **2026-06-26** — Tier 1–2 token optimization for context and tool output.
+- **2026-06-28** — Repair broken tool turns in memory before provider replay.
+- **2026-06-29** — Opt-in terse emission-style guidance in the harness prompt.
+- **2026-07-01** — Opt-in session transcript capture for harness debugging (`GET` usage, SSE, usage DB).
+- **2026-07-01** — Prompt-first scheduled loops: `start_loop` tool, scheduler worker, and Firestore-backed loop store.
+
+#### Memory & context
+- **2026-05-14** — Memory (`monkeybot.core.memory`): markdown files under `MEMORY_PATH` with optional `INDEX.md` snapshotted into context; `search_memory` for on-demand lookup; mid-turn refresh via `refresh_memory_index()`.
+- **2026-05-14** — Memory organizer (`monkeybot.core.memory.organizer`) — async post-turn classifier that updates `INDEX.md` and routes new entries to the right markdown file.
+- **2026-05-15** — Context curation configuration (`CONTEXT_CURATION_*` env vars) and optional secondary LLM curator pass.
+- **2026-07-02** — Hybrid memory curation: append-only INDEX with archive cap, sliding `memory_window_lines`, structural coverage/confidence with `search_memory` nudge when truncated, optional LLM curator (`mode`: window/curator/hybrid), and index fingerprint cache to skip repeat curator calls.
+- **2026-07-09** — Simplified context curation to a single path (recent window; curator only when token-heavy). Removed `CONTEXT_CURATION_MODE` / `window`/`curator`-only modes and dropped `memory_threshold`, `max_memory_lines`, and `search_max_hits` knobs (#67).
+- **2026-07-02** — Skills discovered via `list_skills` instead of full prompt injection; skill names always injected from `ctx.skills`; `list_skills`/`read_file` remain the path for the skills root and full `SKILL.md` procedure.
+
+#### Tools, skills & workspace
+- **2026-05-14** — MCP (`mcp_client.py`, `ports_mcp.py`) — stdio + streamable HTTP MCP servers loaded from `MCP_CONFIG`; tools exposed as `server__tool`.
+- **2026-05-16** — Web search integration and enhanced tool invocation.
+- **2026-05-20** — MCP OAuth2 client credentials and password grant with strict validation.
+- **2026-05-14** — Skills (`monkeybot.core.context._discover_skills`, `monkeybot.skills.{loader,executor}`) — folder-based skills under `SKILLS_PATH` with `SKILL.md` per skill.
+- **2026-05-14** — Workspace tools (`workspace_tools.py`, `workspace_service.py`) — read/write/edit/find under a configurable workspace scope; paths under `.monkeybot` bypass `WORKSPACE_WRITE_SCOPE_REL`.
+- **2026-06-24** — `render_image` tool, `ImageBlock` SSE events, and Gemini image-generation fixes.
+- **2026-06-24** — Default `deny_patterns` block package installs via `run_command`.
+- **2026-06-30** — Browser MCP integration (`integrations/browser-mcp/`) with tool result ingress guards.
+- **2026-07-02** — YAML frontmatter `description` parsing for `list_skills`.
+
+#### Providers
+- **2026-05-14** — Provider adapters: Vertex / Gemini, OpenAI, Anthropic, Anthropic-on-Vertex. Resolved via `monkeybot.core.config.get_provider_config()`.
+- **2026-05-18** — HuggingFace Inference API provider.
+- **2026-05-18** — OpenTelemetry observability integration with runbook and configuration.
+- **2026-06-22** — Provider prompt caching, cost telemetry, and playground model UI.
+- **2026-06-30** — Ollama provider for local models.
+- **2026-06-30** — Shared stream / `count_input_tokens` logic for OpenAI-compatible providers.
+- **2026-07-01** — NVIDIA NIM provider (`monkeybot[nvidia]`).
+- **2026-07-03** — Vertex `google_search` grounding for Gemini (agent turns only); CLI display for grounding metadata.
+
+#### Storage & persistence
+- **2026-05-17** — Storage abstraction layer (SQLite / Postgres, Step 1 + 1.5).
+- **2026-05-17** — Pluggable memory storage (`WorkspaceStorage` + `MemorySubsystem`, Step 2).
+- **2026-06-23** — Firestore backend, worker pool, and playground chat history.
+- **2026-06-30** — Opt out of auto schema via `paths.auto_schema` in `monkeybot.yaml`.
+
+#### CLI & developer experience
+- **2026-06-24** — Standalone `monkeybot` CLI for agent setup and terminal chat (`monkeybot new`, `monkeybot chat`, `monkeybot run`).
+- **2026-06-25** — Named subagent personas via `monkeybot.yaml` and `task(subagent_type)`.
+- **2026-06-25** — `monkeybot` skill as a [skills.sh](https://skills.sh) entry point for onboarding.
+- **2026-06-26** — Pinned session status bar in `monkeybot chat`.
+- **2026-06-30** — Self-contained `demo_agent/` example (replaces playground) with its own `pyproject.toml` and editable path dependency.
+- **2026-06-30** — `develop` → `main` release process and `scripts/release.py` helpers.
+- **2026-07-01** — Chat UX polish and Ollama thinking-level control.
+
+#### Evals & testing
+- **2026-05-18** — Evals service, playground UI, and agent behavior tests.
+- **2026-07-01** — Live eval PR scorecard: telemetry, requirement gates, smoke suite, and CI wiring.
+
+#### Deployment & packaging
+- **2026-05-17** — Public Docker artifacts (Step 3): `docker-compose.yml`, `docker/opensandbox.docker.toml`, `.env.example`, `docker/Dockerfile` with `HEALTHCHECK`.
+- **2026-05-17** — Step 4 deployment guides (Pattern A, B, C).
+- **2026-05-17** — Harness-as-library (Step 5) for embedding the runtime in other services.
+- **2026-05-18** — OSS sanitization: gitignore `internal/`, GCP placeholders, public playground Docker.
+- **2026-05-16** — Opt-in OpenSandbox execution backend.
+- **2026-05-14** — Demo agent under `demo_agent/`, default skills under `.agents/skills/`.
+- **2026-05-14** — Docs (v2): `docs/getting-started.md`, `docs/skills.md`; configuration reference in `.env.example`.
+- **2026-05-14** — Test + bench infra: `tests/` (pytest + pytest-asyncio) and `testing/bench.py`.
+
+#### Multimodal & UI
+- **2026-06-22** — Multimodal attachments and refreshed playground chat UI.
+- **2026-06-24** — Chat UI interleaves assistant prose with tool cards in the transcript.
+
+### Changed
+
+- **2026-05-14** — Packaging: `pyproject.toml` authors set to `human-plus-machine`; repository URLs point at `https://github.com/human-plus-machine/monkeybot`. Build backend is `hatchling`; package layout is `src/monkeybot`.
+- **2026-05-14** — Default `SKILLS_PATH` is `./.agents/skills` (matches `.env.example` and `docker/Dockerfile`).
+- **2026-05-16** — Core module restructure and configuration cleanup; legacy files removed.
+- **2026-06-24** — Improved tool failure recovery and progress visibility in prompts.
+- **2026-06-25** — Harness context budgeting and unified provider sampling parameters.
+- **2026-06-26** — Gateway spawned from the agent project's Python env instead of the CLI env.
+- **2026-06-30** — Scaffold consolidated packaged defaults; unified on `monkeybot new`.
+- **2026-06-30** — Provider and runtime paths deduplicated; observability gap logging improved.
+- **2026-07-02** — Pre-flight prompt tokens: summarization threshold and `estimated_prompt_tokens` use each provider's tokenizer / count API (`Provider.count_input_tokens`). OpenAI installs should include the `openai` extra (adds `tiktoken`).
+- **2026-07-02** — Configurable history summarization model via `CONTEXT_SUMMARIZATION_MODEL`, optional `model.summarization_model` in `monkeybot.yaml`, or `TurnContext.summarization_model`; main turn still uses `ctx.model`.
+
+### Fixed
+
+- **2026-05-14** — Anthropic harness tool-call replay correctness.
+- **2026-05-18** — Gateway resolves LLM providers via `get_provider_config`.
+- **2026-06-23** — Task queue, worker claims, and session resume hardened.
+- **2026-06-29** — Agent-root resolution, malformed tool args, and chat stream exit code.
+- **2026-07-01** — OpenAI-compatible providers request stream usage metadata.
+- **2026-07-03** — Skill names restored in prompt; session teardown on disconnect.