monkeybot 3.2.0__tar.gz → 3.3.0__tar.gz

{monkeybot-3.2.0 → monkeybot-3.3.0}/CHANGELOG.md

@@ -6,7 +6,30 @@ the project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
-### Browser MCP
+## [browser v0.7.0] - 2026-09-10
+
+#### Added
+
+- Announces the chat it is acting for to the Spaces in-app bridge (`Monkeybot.setChatScope`) so tabs stay attached to their chat; silently no-op on older apps.
+
+#### Fixed
+
+- Chat-switch tab drop now fires on real tool calls (`browser_harness()` reuse no longer forgets the last scoped chat).
+
+## [core v3.3.0] - 2026-09-11
+
+### Breaking
+
+- `run_command` now runs inside a deny-by-default OS filesystem jail (macOS `sandbox-exec`; Linux mount-namespace, unvalidated on a real host as part of this change) on top of the existing binary/path allowlist. The user's home directory is denied by default; the workspace, artifacts, memory palace, and OS temp dirs stay read+write, and skills/the interpreter prefix/granted folders stay read-only, including when they sit inside the denied home directory (the normal case for a desktop app). This closes a real gap: the old argv-string path screen never caught indirect path expressions a shell or interpreter builds at runtime (`bash -c 'cp "$HOME/Desktop/x" .'`, or a Python `os.path.expanduser(...)` call), so a command that depended on reading/writing somewhere under `$HOME` outside the workspace — by accident or on purpose — will now fail where it previously succeeded. `git` keeps working via a narrow, explicit `~/.gitconfig`/`~/.config/git/ignore` read carve-out (needed even for `--version`); `gh` does not — its own auth config is credential-adjacent and is not carved out, matching the credential-path denylist already established for `computer_*` tools. If the OS jail mechanism itself is unavailable on a host (older kernels without unprivileged user namespaces, some hardened/CI Linux configs), `run_command` falls back to running **unconfined** (logged once, not per call) rather than refusing every command — a deliberate difference from the existing memory-off hide mechanism, which still fails closed, since this is default-on hardening for every deployment rather than a narrow, deliberate opt-out.
+
+### Added
+
+- MCP tool calls now carry `_meta.monkeybot` (`thread_id`, `request_id`, `run_id`) so servers can attribute work to a chat. Requires `mcp>=1.27.1` so `ClientSession.call_tool(meta=)` is always available.
+- **Command grants:** an unlisted `run_command` binary now surfaces a "Needs your OK" approval card (`Decision.grant_key`/`grant_kind` on `CommandTierInspector`) instead of silently falling through to a hard `SecurityError` at the executor. "Allow once" covers the rest of the turn; "Always allow" writes a durable rule to a new home-level store, `grants.json` (`core/tools/grant_store.py`), shared by every agent on the machine — deliberately separate from the per-agent, `computer_*`-only `approvals.json`. Same on-disk contract (JSON, `0600`, atomic replace, cross-process exclusive-create locking matched with the Electron side).
+- **Folder read grants:** `read_file`/`load_file`/`glob`/`grep` on an absolute path outside the workspace now ask via a new `PathGrantInspector` rather than rejecting outright — denying credential paths and anything outside `$HOME` hard, never promotable. An approved folder is read in place through `WorkspaceFileService.extra_read_roots` (symlink-escape-protected, read-only — never widens what `write_file`/`replace_in_file` can touch); the same granted folders feed the `run_command` jail's read-only set so the shell tool and the file tools agree on what's reachable. Fixes the failure mode where the model, unable to read a file outside its workspace and told only "use a relative path," would narrate copying the file into the workspace to route around the boundary — tool descriptions, the harness prompt, and the `workspace_error_envelope` hint for this case now say to ask for access instead, explicitly calling relocating-to-route-around-the-boundary a policy violation.
+- Settings → Privacy & access gained **Allowed commands** and **Folder access** sections listing/revoking these new grants, alongside the existing per-agent `computer_*` rules.
+
+## [browser v0.6.0] - 2026-09-07
 
 #### Added
 

{monkeybot-3.2.0 → monkeybot-3.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: monkeybot
-Version: 3.2.0
+Version: 3.3.0
 Summary: monkeybot agent harness — FastAPI SSE gateway, owned loop, SQLite, and MCP.
 License: MIT
 License-File: LICENSE
@@ -9,7 +9,7 @@ Requires-Dist: aiosqlite>=0.20.0
 Requires-Dist: fastapi>=0.115.0
 Requires-Dist: google-genai>=1.0.0
 Requires-Dist: httpx>=0.27.0
-Requires-Dist: mcp<2,>=1.0.0
+Requires-Dist: mcp<2,>=1.27.1
 Requires-Dist: numpy<2.5,>=1.26.0
 Requires-Dist: pydantic>=2.10.0
 Requires-Dist: python-dotenv>=1.0.0

{monkeybot-3.2.0 → monkeybot-3.3.0}/docs/browser-mcp.md

@@ -189,6 +189,39 @@ other ephemeral-workspace targets they reset when the instance is recycled. Use
 the memory storage contract for durable knowledge rather than adding a workspace
 synchronization layer.
 
+## In-app bridge extensions
+
+When the Spaces in-app browser is bound, each tool call may announce which chat
+it is acting for so new tabs stay attached to that chat. AgentCore and Browser
+Use Cloud backends never send this.
+
+### MCP request meta
+
+The gateway includes `_meta` on every `call_tool`:
+
+```json
+{ "monkeybot": { "thread_id": "<gateway thread id>", "request_id": "<turn request id>", "run_id": "<MONKEYBOT_RUN_ID or null>" } }
+```
+
+Servers that ignore `_meta` are unaffected. Older gateways send nothing; this
+server then announces `chatKey` as `null`.
+
+### `Monkeybot.setChatScope`
+
+On every in-app tool call, after the harness binds and before other CDP
+commands, the backend sends:
+
+```json
+{ "id": 7, "method": "Monkeybot.setChatScope", "params": { "chatKey": "<thread_id or null>" } }
+```
+
+`chatKey` is the gateway `thread_id` from `_meta.monkeybot`, which equals the
+app's session ID. The bridge stores it on the WebSocket client until changed. An
+older app replies with an error; this server treats that as unsupported, stops
+sending the method for the rest of the connection, and continues normally.
+Rebinding the in-app daemon (including after Spaces `warmBrowserOnLaunch`)
+clears that disabled flag so a newer app gets a fresh attempt.
+
 ## Tools
 
 Navigation, interaction, screenshots, tabs, waits, playbooks (`browser_list_playbooks`, `browser_read_playbook`, `browser_write_playbook`, `browser_run_playbook`), `browser_login` for Spaces-saved passwords (returns `{ok, loggedIn, origin, mfa?, mode?}` — never the password), and `browser_stop` for daemon cleanup.

{monkeybot-3.2.0 → monkeybot-3.3.0}/docs/features.md

@@ -259,20 +259,20 @@ Each section follows: **Purpose** · **Key files** · **How it works** · **Depe
 
 **Purpose:** Default `ToolExecutorPort` — built-ins, MCP, custom tools, subagents.
 
-**Key files:** `core/tools/core_tool_executor.py`, `terminal.py`, `workspace_service.py`, `patch.py`, `sandbox_executor.py`, `spill_inventory.py`
+**Key files:** `core/tools/core_tool_executor.py`, `terminal.py`, `workspace_service.py`, `patch.py`, `sandbox_executor.py`, `spill_inventory.py`, `fs_isolation.py`, `grant_store.py`
 
 **Built-in tools** (from `context._core_tool_defs`):
 
 | Tool | Role |
 |------|------|
-| `read_file` / `write_file` | `skills/...` read-only or workspace-relative paths |
+| `read_file` / `write_file` | `skills/...` read-only or workspace-relative paths; `read_file`/`load_file` also accept an absolute path outside the workspace once the user grants that folder (see §5) — read in place, never copied in |
 | `replace_in_file` | Unique (or `replace_all`) substring edit; exact then light fuzzy match |
-| `glob` / `grep` | Path discovery / content regex search (prefer over shell) |
+| `glob` / `grep` | Path discovery / content regex search (prefer over shell); `root` accepts a granted external folder the same way `read_file` does |
 | `apply_patch` | Multi-file Codex-style Add/Update/Delete/Move; fail-closed before any write |
 | `search_memory` | Keyword search in memory tree |
 | `search` / `recall` | Local knowledge index (workspace + notes); **parallel-safe**. Gateway owns writes; subagents open the index **read-only**. Harness-as-library (Pattern B/C) callers can opt into read-only via `MONKEYBOT_KNOWLEDGE_READ_ONLY=1`; the gateway always ignores this flag and stays the writer |
 | `list_skills` | Skill discovery |
-| `run_command` | Allowlisted shell (host or OpenSandbox) |
+| `run_command` | Allowlisted **and OS-confined** shell (host or OpenSandbox) — see the workspace jail below |
 | `task` | Subagent subprocess (parent only) |
 | `enable_mcp` / `disable_mcp` | Catalog connect / disconnect (success includes status) |
 | `enable_loops` | Progressive advertise scheduled-loop tools |
@@ -296,6 +296,8 @@ Each section follows: **Purpose** · **Key files** · **How it works** · **Depe
 - Nested `task` disabled inside subagents.
 - Custom tools must not collide with core or MCP names.
 - `MONKEYBOT_KNOWLEDGE_READ_ONLY` (default off) opens the knowledge index read-only for `create_harness_deps` (Pattern B/C) callers; subagent workers are always read-only regardless of the flag. The gateway SSE app is the sole writer per workspace and ignores this flag, logging a warning if it is set.
+- **The workspace jail:** `run_command` runs under a deny-by-default OS filesystem policy (`fs_isolation.py::JailRoots`/`jailed_argv`), not just the `allowed_path_prefixes` argv screen (which a shell or interpreter defeats trivially — `bash -c 'cp "$HOME/Desktop/x" .'` never contains a literal `~`/`/` token an argv scanner can catch). The jail denies the user's home directory by default, then allows the workspace/artifacts/memory-palace/OS-temp-dirs back on top (read+write) and skills/interpreter-prefix/granted folders (read-only) — including when those sit inside the denied home directory, the normal case for a desktop app. Implemented for macOS `sandbox-exec`; the Linux mount-namespace path follows the same structure but is unvalidated on a real Linux host — both fail *closed* (refuse to run) if the OS mechanism can't be established, except that the jail itself (unlike the older memory-hide mechanism) fails *open*, once, with a logged warning, if neither OS mechanism is available at all — a default-on hardening that must not turn into "run_command stops working" on unsupported hosts.
+- **Folder read grants:** `read_file`/`load_file`/`glob`/`grep` on an absolute path outside the workspace ask via `PathGrantInspector` (§5) rather than dead-ending; an approved folder is read in place through `WorkspaceFileService.extra_read_roots` — nothing is copied into the workspace, and the same granted folders feed the jail's read-only set above so `run_command` and the file tools agree on what's reachable.
 
 ---
 
@@ -303,13 +305,14 @@ Each section follows: **Purpose** · **Key files** · **How it works** · **Depe
 
 **Purpose:** Pre-flight policy gates; supports user confirmation via SSE.
 
-**Key files:** `core/tools/inspector.py`, `core/tools/permission.py`, `core/tools/loop_inspector.py`
+**Key files:** `core/tools/inspector.py`, `core/tools/permission.py`, `core/tools/loop_inspector.py`, `core/tools/path_grant_inspector.py`, `core/tools/grant_store.py`
 
 **Inspectors wired at gateway startup (order matters — first deny/confirm wins):**
-1. `CommandTierInspector` — `command_allowlist.yaml` deny-regex preflight; execution allowlists stay on the executor
-2. `RulesInspector` — `MONKEYBOT_TOOL_DENIED_PATTERNS` substring deny list (backward compat)
-3. `PermissionInspector` — `permissions.yaml` last-match-wins `allow` / `ask` / `deny` ruleset (`PERMISSION_CONFIG`)
-4. `LoopStartInspector` — `start_loop` always asks for confirmation (rich plan preview)
+1. `CommandTierInspector` — `command_allowlist.yaml` deny-regex preflight (hard, never promotable), then a binary allow/ask gate: a binary already on the static allowlist, in `grants.json`, or granted "Allow once" earlier this turn is allowed and the chain continues (`permissions.yaml` can still ask/deny a finer-grained pattern on top, unchanged); any other binary asks (`confirm`, carrying `grant_key`=the binary) instead of silently falling through to a hard rejection at the executor
+2. `PathGrantInspector` — for `read_file`/`load_file`/`glob`/`grep`, an absolute/`~` path inside the workspace is a no-op (allow); on the credential denylist or outside `$HOME` it's a hard deny; already covered by a `grants.json`/turn-scoped folder grant it's allow; otherwise it asks (`confirm`, `grant_key`=the containing folder, `grant_kind="path"`)
+3. `RulesInspector` — `MONKEYBOT_TOOL_DENIED_PATTERNS` substring deny list (backward compat)
+4. `PermissionInspector` — `permissions.yaml` last-match-wins `allow` / `ask` / `deny` ruleset (`PERMISSION_CONFIG`)
+5. `LoopStartInspector` — `start_loop` always asks for confirmation (rich plan preview)
 
 **Permission ruleset (`permissions.yaml`):**
 - Rules are ordered; **last match wins** (OpenCode-style).
@@ -318,15 +321,17 @@ Each section follows: **Purpose** · **Key files** · **How it works** · **Depe
 - `default:` applies when nothing matches (shipped default: `allow`).
 - Session approvals: POST tool-confirmation with `{approved: true, always: true}` remembers tool+resource for the rest of the session (`SessionBus.session_approvals`).
 
-**Decision kinds:** `allow` | `deny` | `confirm` (requires `ctx.sse_bus` for pending UI response).
+**Decision kinds:** `allow` | `deny` | `confirm` (requires `ctx.sse_bus` for pending UI response). A `confirm` may carry `grant_key`/`grant_kind` (`"command"` | `"path"`) — what an "Allow once"/"Always allow" click actually remembers (a binary name or a folder, never the full resource string `resource_for_call()` would otherwise use, which would make a durable rule cover exactly one invocation). `tool_dispatch.py` routes an "always" approval to `ctx.grants_persist` (writing `grants.json`, shared by every agent) when `grant_kind` is set, instead of the `computer_*`-only `ctx.approvals_persist`; either way, "Allow once" also records the grant on `ctx.turn_command_grants`/`ctx.turn_path_grants` so a repeat call later in the same turn does not ask again even without a durable write.
 
-**Hard constraints underneath soft asks:** `allowed_commands` / `allowed_path_prefixes` + sandbox still enforce at execution time — permission `ask`/`allow` cannot bypass them.
+**`grants.json`** (`core/tools/grant_store.py`) is a home-level store — one file shared by every agent on the machine, deliberately distinct from the per-agent, `computer_*`-only `approvals.json` (§21). Same on-disk contract: JSON, mode `0600`, atomic replace, cross-process exclusive-create locking matched byte-for-byte with the Electron side (`electron/main/grants.ts`).
+
+**Hard constraints underneath soft asks:** `allowed_commands` / `allowed_path_prefixes` + sandbox still enforce at execution time — permission `ask`/`allow` cannot bypass them. Beyond the argv allowlist, `run_command` additionally runs inside a deny-by-default OS filesystem jail (§4) that a shell/interpreter cannot argue its way around by rewriting a path.
 
 **Invariants:**
 - Missing allowlist file → tier inspector skipped (logged); executor falls back to code defaults.
 - Missing `permissions.yaml` → soft ruleset disabled (logged).
-- Default deny patterns block package installs (`pip install`, `npm install`, etc.).
-- Confirm without `sse_bus` → deny.
+- Default deny patterns block package installs (`pip install`, `npm install`, etc.) and are never promotable to a confirm by any grant.
+- Confirm without `sse_bus` → deny (this is why a subagent, which has no interactive session, can use an already-durably-granted command/folder transparently but can never ask for a new one).
 
 ---
 
@@ -652,7 +657,7 @@ Before spawning the gateway, the CLI probes that interpreter for MonkeyBot `>=3.
 
 **How it works:**
 - Off by default, macOS-only: `computer.enabled: true` in `monkeybot.yaml` → `MONKEYBOT_COMPUTER_TOOLS` env, combined with a hard `sys.platform == "darwin"` check (`should_enable_computer_tools()`). The desktop app sets the env var when it spawns a gateway with the feature turned on in Settings; no other deployment should ever set it.
-- **Hard security boundary lives in the tool bodies, not in `permissions.yaml`** (`safety.py`): every path is resolved and validated against the user's home directory after following symlinks; a fixed denylist blocks credential directories (`.ssh`, `.aws`, keychains, browser profiles, the app's own config) both at their canonical location *and* by directory-name anywhere in the tree; filenames matching credential patterns (`.env`, `*.pem`, `id_rsa*`, …) are always refused; `computer_open` refuses any path/app that would make `open` execute code (`.command`, `.app`, `.sh`, Terminal, script editors, …); trash never hard-deletes. `permissions.yaml` is fail-open (a broken file silently disables it), so none of this can depend on it.
+- **Hard security boundary lives in the tool bodies, not in `permissions.yaml`** (`safety.py`): every path is resolved and validated against the user's home directory after following symlinks; a fixed denylist blocks credential directories (`.ssh`, `.aws`, keychains, browser profiles, the app's own config) both at their canonical location *and* by directory-name anywhere in the tree; filenames matching credential patterns (`.env`, `*.pem`, `id_rsa*`, …) are always refused; `computer_open` refuses any path/app that would make `open` execute code (`.command`, `.app`, `.sh`, Terminal, script editors, …); trash never hard-deletes. `permissions.yaml` is fail-open (a broken file silently disables it), so none of this can depend on it. `_denied_dirs()` also always includes `MONKEYBOT_WORKSPACE_ROOT` (not only under `MONKEYBOT_APP_HOME`, which only the desktop app sets) — a CLI-scaffolded agent's workspace can sit anywhere under `$HOME` the user chose, and `computer_move`/`computer_trash` must not be able to relocate a file straight into or out of it, one click away from smuggling exactly what the workspace boundary (§4) exists to prevent. `computer_move`'s own description now says so, so the model doesn't reach for it as a `read_file`/`run_command` workaround.
 - **Every `computer_*` call asks by default**, via a built-in baseline rule (`COMPUTER_BASELINE_RULES` in `permissions.py`) — not a line in `permissions.yaml`, so it can't be silently defeated by a missing/broken config file. `ComputerAwarePermissionInspector` layers, last-match-wins: baseline `ask` < durable approvals overlay `allow` < the user's `permissions.yaml` (highest authority — a hand-written `deny` always wins).
 - **"Always allow" is durable and narrow**: `monkeybot_config/approvals.json` (machine-written, JSON — deliberately *not* appended into `permissions.yaml`, which is a comment-heavy file the app's Advanced settings save wholesale) stores one exact `(tool, resource)` pair per rule. Mutating tools (`computer_move`, `computer_trash`) are excluded from `ALWAYS_SCOPE` — their resource is the *source* path only, so an "always" rule would cover any destination — every call to them asks. The inspector re-`stat`s the overlay file on every check and reloads on change; on a genuine change it also clears the session-level approval cache, so a revoke in the app's Settings takes effect immediately rather than waiting for a gateway restart.
 - Registered via the standard `extra_tools` extension point in both the SSE (`gateway/sse/app.py`) and realtime (`gateway/realtime/routes.py`) gateways — same mechanism as `web_search`/`todo_list`. Never registered for subagents (`subagent_worker.py` builds its own `extra_tools` independently and never imports this package).

{monkeybot-3.2.0 → monkeybot-3.3.0}/integrations/browser-mcp/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "monkeybot-browser-mcp"
-version = "0.5.0"
+version = "0.7.0"
 description = "monkeybot MCP server wrapping browser-harness for real-browser control and site playbooks."
 requires-python = ">=3.11"
 dependencies = [

{monkeybot-3.2.0 → monkeybot-3.3.0}/integrations/browser-mcp/src/browser_mcp/app.py

@@ -93,15 +93,14 @@ def _public_tool(fn: Callable[_P, str]) -> Callable[_P, str]:
 
     @functools.wraps(fn)
     def wrapper(*args: _P.args, **kwargs: _P.kwargs) -> str:
-        with _TOOL_LOCK:
-            with perf.timed_tool(fn.__name__) as rec:
-                try:
-                    result = fn(*args, **kwargs)
-                    rec.observe(result)
-                    return result
-                except Exception as exc:
-                    rec.fail()
-                    in_app_cdp._reraise_public_harness_error(exc)
+        with _TOOL_LOCK, perf.timed_tool(fn.__name__) as rec:
+            try:
+                result = fn(*args, **kwargs)
+                rec.observe(result)
+                return result
+            except Exception as exc:
+                rec.fail()
+                in_app_cdp._reraise_public_harness_error(exc)
 
     # FastMCP copies fn.__doc__ as-is (not inspect.getdoc), so without this the
     # model sees the 4-space body indent from the source. @mcp.tool() wraps

{monkeybot-3.2.0 → monkeybot-3.3.0}/integrations/browser-mcp/src/browser_mcp/backend.py

@@ -6,7 +6,7 @@ import contextlib
 import logging
 from typing import Any
 
-from browser_mcp import agentcore, dom_indexing, in_app_cdp, perf, tabs
+from browser_mcp import agentcore, chat_scope, dom_indexing, in_app_cdp, perf, tabs
 
 logger = logging.getLogger(__name__)
 
@@ -23,6 +23,24 @@ def mark_unbound() -> None:
     _bound_cdp = None
 
 
+def in_app_backend_active() -> bool:
+    """True when the live binding is Monkeyapp's in-app CDP bridge."""
+    return (
+        _bh is not None
+        and _bound_cdp not in (None, "agentcore")
+        and in_app_cdp._env_set_from_in_app_file
+    )
+
+
+def in_app_helpers() -> Any | None:
+    """Return in-app CDP helpers when the in-app backend is bound, else None."""
+    if not in_app_backend_active():
+        return None
+    assert _bh is not None
+    helpers, _ = _bh
+    return helpers
+
+
 def teardown_bound_backend() -> None:
     """Tear down whatever backend _bh is currently bound to, if any.
 
@@ -42,6 +60,7 @@ def teardown_bound_backend() -> None:
         tabs.registry().detach_all(helpers)
     _bh = None
     dom_indexing.clear_registered_targets()
+    chat_scope.reset()
     if is_agentcore:
         admin.stop_session()
         from browser_mcp import playwright_helpers
@@ -58,6 +77,12 @@ def _with_perf_helpers(bh: tuple[Any, Any]) -> tuple[Any, Any]:
     return perf.wrap_helpers(helpers), admin
 
 
+def _announce_in_app(helpers: Any) -> None:
+    """Scope the in-app bridge after bind. Playbook/login skip this by not binding."""
+    if in_app_cdp._env_set_from_in_app_file:
+        chat_scope.announce_current(helpers)
+
+
 def _reconnect_agentcore() -> tuple[str, dict[str, str]]:
     """Force a fresh AgentCore session (stop + restart) and return new ws creds.
 
@@ -105,7 +130,9 @@ def browser_harness() -> tuple[Any, Any]:
         return _with_perf_helpers(_agentcore_browser_harness())
 
     if _bh is not None and cdp == _bound_cdp:
-        return _with_perf_helpers(_bh)
+        wrapped = _with_perf_helpers(_bh)
+        _announce_in_app(wrapped[0])
+        return wrapped
 
     if _bound_cdp == "agentcore":
         teardown_bound_backend()
@@ -126,6 +153,9 @@ def browser_harness() -> tuple[Any, Any]:
     admin.ensure_daemon()
     _bh = (helpers, admin)
     _bound_cdp = cdp
+    if in_app_cdp._env_set_from_in_app_file:
+        chat_scope.reset()
+    _announce_in_app(helpers)
     return _with_perf_helpers(_bh)
 
 
@@ -153,6 +183,7 @@ def stop_active_backend_best_effort() -> None:
         with contextlib.suppress(Exception):
             tab_ops._close_agent_opened_tabs(helpers)
     _bh = None
+    chat_scope.reset()
     from browser_harness import admin
 
     admin.restart_daemon()

monkeybot-3.3.0/integrations/browser-mcp/src/browser_mcp/chat_scope.py

@@ -0,0 +1,139 @@
+"""Chat identity for the Spaces in-app CDP bridge.
+
+The gateway may pass ``_meta.monkeybot.thread_id`` on each MCP tool call.
+When driving the in-app browser, we announce that id as ``Monkeybot.setChatScope``
+before other CDP commands so new tabs attach to the right chat.
+"""
+
+from __future__ import annotations
+
+import logging
+import re
+from typing import Any
+
+logger = logging.getLogger(__name__)
+
+# JSON-RPC "Method not found" — Chrome's reply when the app has no setChatScope.
+_JSONRPC_METHOD_NOT_FOUND = -32601
+_CDP_ERROR_CODE_RE = re.compile(r"""['"]code['"]\s*:\s*(-?\d+)""")
+
+_UNSET: object = object()
+_last_chat: object = _UNSET
+_unsupported: bool = False
+
+
+def reset() -> None:
+    """Clear last-chat / unsupported flags after a daemon (re)bind."""
+    global _last_chat, _unsupported
+    _last_chat = _UNSET
+    _unsupported = False
+
+
+def current_thread_id() -> str | None:
+    """Return the gateway thread id from this request's ``_meta``, if any.
+
+    Never raises. Returns ``None`` outside a request or when the extra is absent.
+    """
+    try:
+        from browser_mcp.app import mcp
+
+        ctx = mcp.get_context()
+        meta = getattr(getattr(ctx, "request_context", None), "meta", None)
+        return _thread_id_from_meta(meta)
+    except LookupError:
+        return None
+    except Exception:
+        logger.debug("browser-mcp: current_thread_id failed", exc_info=True)
+        return None
+
+
+def _thread_id_from_meta(meta: object) -> str | None:
+    """Read ``monkeybot.thread_id`` from FastMCP's pydantic ``RequestParams.Meta``."""
+    if meta is None:
+        return None
+    monkeybot: Any = getattr(meta, "monkeybot", None)
+    if not isinstance(monkeybot, dict):
+        return None
+    thread_id = monkeybot.get("thread_id")
+    if thread_id is None:
+        return None
+    text = str(thread_id).strip()
+    return text or None
+
+
+def _forget_other_chat_tabs() -> None:
+    """Drop this process's tab registry: those targets belong to the chat we left.
+
+    Spaces owns the previous chat's tabs and keeps them in that chat's panel.
+    Forgetting ``opened_by_agent`` here is intentional: ``browser_stop`` in the
+    new chat must not close the previous chat's tabs.
+    """
+    from browser_mcp import tabs
+
+    tabs.reset_registry()
+
+
+def _cdp_error_code(exc: BaseException) -> int | None:
+    """Best-effort CDP/JSON-RPC error code from a harness ``RuntimeError``."""
+    payload = exc.args[0] if exc.args else None
+    if isinstance(payload, dict):
+        code = payload.get("code")
+        if isinstance(code, int):
+            return code
+    match = _CDP_ERROR_CODE_RE.search(str(exc))
+    if match:
+        return int(match.group(1))
+    return None
+
+
+def _looks_like_unknown_method(exc: BaseException) -> bool:
+    if _cdp_error_code(exc) == _JSONRPC_METHOD_NOT_FOUND:
+        return True
+    text = str(exc).lower()
+    return "unknown method" in text or "method not found" in text
+
+
+def announce_current(helpers: object) -> None:
+    """Announce this request's thread id. Never raises."""
+    announce(helpers, current_thread_id())
+
+
+def announce(helpers: object, thread_id: str | None) -> None:
+    """Send ``Monkeybot.setChatScope`` for this request. Never raises.
+
+    CDP is sent on every call (idempotent) so a reconnected WebSocket still gets
+    ``chatKey``. The tab registry is dropped only when the non-None thread id
+    changes. ``_last_chat`` is updated even when the app does not support the
+    method, so a chat switch still drops tabs owned by the previous chat.
+    """
+    global _last_chat, _unsupported
+    previous = _last_chat
+    switched = (
+        thread_id is not None and previous is not _UNSET and previous != thread_id
+    )
+    if thread_id is not None:
+        _last_chat = thread_id
+    if switched:
+        _forget_other_chat_tabs()
+        logger.info(
+            "browser-mcp: chat scope changed %s -> %s; dropping tabs",
+            previous,
+            thread_id,
+        )
+    if _unsupported:
+        return
+    cdp = getattr(helpers, "cdp", None)
+    if not callable(cdp):
+        _unsupported = True
+        logger.warning("browser-mcp: helpers have no cdp(); disabling setChatScope")
+        return
+    try:
+        cdp("Monkeybot.setChatScope", chatKey=thread_id)
+    except Exception as exc:
+        if _looks_like_unknown_method(exc):
+            _unsupported = True
+            logger.warning(
+                "browser-mcp: Monkeybot.setChatScope unsupported; disabling for this connection"
+            )
+        else:
+            logger.warning("browser-mcp: Monkeybot.setChatScope failed", exc_info=True)

{monkeybot-3.2.0 → monkeybot-3.3.0}/integrations/browser-mcp/src/browser_mcp/in_app_cdp.py

@@ -9,6 +9,8 @@ from pathlib import Path
 from typing import NoReturn
 from urllib.parse import parse_qsl, urlencode, urlparse, urlunparse
 
+from browser_mcp import chat_scope
+
 logger = logging.getLogger(__name__)
 
 # Written by Monkeyapp when the in-app Electron CDP bridge is live. Prefer this over
@@ -150,9 +152,12 @@ def _redact_cdp_token(message: str) -> str:
 def _bind_in_app_endpoint(url: str, token: str | None) -> str:
     global _env_set_from_in_app_file
     endpoint = _in_app_ws_url(url, token)
+    prev = os.environ.get("BU_CDP_WS")
     os.environ["BU_CDP_WS"] = endpoint
     os.environ.pop("BU_CDP_URL", None)
     _env_set_from_in_app_file = True
+    if prev != endpoint:
+        chat_scope.reset()
     return endpoint