monkeybot 3.3.0__tar.gz → 3.5.0__tar.gz

{monkeybot-3.3.0 → monkeybot-3.5.0}/CHANGELOG.md

@@ -6,6 +6,58 @@ the project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [core v3.5.0] - 2026-09-20
+
+### Added
+
+- Native durable goals beside scheduled loops (`create_goal` / `update_goal`, plus `/goals` pause/resume/stop). Continuations are scheduled automatically until the goal completes or is stopped.
+- `FileBlock` SSE for generated documents (path/filename/mime — clients load from disk). Workspace open/export stays inside the workspace and still denies nested credential directories.
+- HTML (`text/html`) uploads for Files preview, and `text/plain` attachments inlined at resolve.
+- Promote a queued follow-up into the live turn (`POST /sessions/{id}/queue/{request_id}/steer`) or drop it (`DELETE`) so it never drains.
+- Verifier: request-scoped mailbox, sticky nudge until the tracker recovers, nudge armed on judge deposit, concurrent session-bound `ProviderJudge` jobs with scoped budgets and fencing, and staged reload so live workers stay intact.
+
+### Changed
+
+- `verifier.enabled: true` turns on omitted nested `ledger` / `tracker` flags. Omitted `judge.enabled` turns on only when the tracker is on. Explicit `enabled: false` still opts a nested section out.
+- Omitted `verifier.ledger.model` / `verifier.judge.model` inherit the agent model (`model.name` / `MODEL_NAME`, then `gemini-2.5-flash`). The live judge worker is session-bound `ProviderJudge`.
+
+### Fixed
+
+- Provider requests that exceed the multimodal byte budget drop media rather than sending an oversized body; remaining oversize fails closed. In-flight media is frozen on abort.
+- Promoted follow-ups no longer vanish if the turn ends before they inject — they restore to the front of the follow-up queue.
+
+### Notes
+
+- Existing configs that set only `verifier.enabled: true` (or `enabled: true` plus `ledger.enabled: true`) now also get the tracker, and the judge if the tracker stays on. Opt out with `tracker.enabled: false` / `judge.enabled: false`.
+
+## [cli v0.7.0] - 2026-09-20
+
+### Added
+
+- New agents install a packaged `skills/goal/SKILL.md` for explicit `/goal` invocations. `monkeybot refresh` adds it when missing.
+
+### Changed
+
+- Example YAML documents verifier nested enable-flag inheritance and optional model inherit.
+
+## [browser v0.7.2] - 2026-09-13
+
+#### Fixed
+
+- Reuse the focused `about:blank` tab when opening a URL so agent `Target.createTarget` does not stack a leftover New tab next to the first real page.
+
+## [browser v0.7.1] - 2026-09-12
+
+#### Fixed
+
+- Empty in-app browsers report `no page target` so `browser_act` / `run_playbook` can `goto` instead of aborting. Stale sessions still fail closed when other tabs exist.
+
+## [core v3.4.0] - 2026-09-12
+
+### Added
+
+- A leading `/slug` in the user turn pins that installed skill for the turn (`## Invoked skill`) without rewriting persisted chat text.
+
 ## [browser v0.7.0] - 2026-09-10
 
 #### Added

{monkeybot-3.3.0 → monkeybot-3.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: monkeybot
-Version: 3.3.0
+Version: 3.5.0
 Summary: monkeybot agent harness — FastAPI SSE gateway, owned loop, SQLite, and MCP.
 License: MIT
 License-File: LICENSE
@@ -11,6 +11,7 @@ Requires-Dist: google-genai>=1.0.0
 Requires-Dist: httpx>=0.27.0
 Requires-Dist: mcp<2,>=1.27.1
 Requires-Dist: numpy<2.5,>=1.26.0
+Requires-Dist: pillow>=10.0.0
 Requires-Dist: pydantic>=2.10.0
 Requires-Dist: python-dotenv>=1.0.0
 Requires-Dist: python-ulid>=2.0.0

{monkeybot-3.3.0 → monkeybot-3.5.0}/cli/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "monkeybot-cli"
-version = "0.6.0"
+version = "0.7.0"
 description = "CLI to create, configure, validate, and chat with monkeybot agents."
 requires-python = ">=3.11"
 dependencies = [

{monkeybot-3.3.0 → monkeybot-3.5.0}/cli/src/monkeybot_cli/scaffold.py

@@ -176,6 +176,13 @@ def install_loop_skill(dest: Path, *, force: bool) -> str:
     return _install_file(target, resources.files(_DEFAULTS_PKG) / "loop" / "SKILL.md", force=force)
 
 
+def install_goal_skill(dest: Path, *, force: bool) -> str:
+    """Install the bundled native-goal procedure into ``skills/goal``."""
+    target = dest / "skills" / "goal" / "SKILL.md"
+    target.parent.mkdir(parents=True, exist_ok=True)
+    return _install_file(target, resources.files(_DEFAULTS_PKG) / "goal" / "SKILL.md", force=force)
+
+
 def install_env_example(dest: Path, *, force: bool) -> str:
     env_example = dest / ".env.example"
     if env_example.exists() and not force:
@@ -399,6 +406,7 @@ def run_refresh(*, dest: Path) -> list[str]:
     report.append(refresh_permissions_if_default(cfg_dir))
     report.append(refresh_monkeybot_yaml(cfg_dir))
     report.extend(ensure_memory(dest, force=False))
+    report.append(f"  skills/goal/SKILL.md: {install_goal_skill(dest, force=False)}")
     return report
 
 
@@ -412,11 +420,12 @@ def run_new(
 ) -> list[str]:
     """Full scaffold: config bundle, empty skills root, writable state, and image files.
 
-    Capability skills (``browser``, ``image-generator``, ``loop``) are packaged
+    Optional capability skills (``browser``, ``image-generator``, ``loop``) are packaged
     under ``scaffold_defaults`` but not installed into new agents for now —
     the Mac Main Agent loads them from ``~/.monkeybot/.internal/skills``
     instead. Re-enable via ``install_*_skill`` when custom agents should get
-    them again.
+    them again. The ``goal`` skill is installed because native goal tools are
+    intentionally exposed only for explicit ``/goal`` invocations.
     """
     cfg_dir = dest / "monkeybot_config"
     report = install_config_bundle(cfg_dir, force=force)
@@ -426,7 +435,7 @@ def run_new(
     )
     report.extend(ensure_memory(dest, force=force))
     report.extend(ensure_workspace(dest, force=force))
-    report.append("  skills/: ensured (empty — capability skills deferred)")
+    report.append(f"  skills/goal/SKILL.md: {install_goal_skill(dest, force=force)}")
     report.append(f"  .env.example: {install_env_example(dest, force=force)}")
     report.extend(install_container_files(dest, force=force))
     report.append(

monkeybot-3.5.0/cli/src/monkeybot_cli/scaffold_defaults/goal/SKILL.md

@@ -0,0 +1,31 @@
+---
+name: goal
+description: Create one durable objective that continues across scheduled turns until completed.
+---
+
+# Goal
+
+Use this skill only when the user explicitly invokes `/goal` with an objective
+that may require multiple turns.
+
+## Start
+
+1. Preserve the user's complete objective without narrowing its scope.
+2. Call `create_goal` exactly once with that objective.
+3. Do the first concrete increment of work in the same turn.
+4. Keep the returned goal id; every `update_goal` call must include it.
+
+## Continue
+
+- Goal continuations are scheduled automatically.
+- Treat the stored objective as authoritative.
+- Make measurable progress and verify results before declaring completion.
+- Temporary session-busy deferrals are normal and are not goal failures.
+- Persistent execution failures stop the goal after the retry limit so it
+  cannot consume resources indefinitely.
+
+## Complete
+
+Call `update_goal` with the returned `goal_id` and `status="complete"` only
+after evidence proves every requirement is satisfied. Otherwise leave the goal
+active. Use the `/goals` control plane to pause, resume, or stop it manually.

{monkeybot-3.3.0 → monkeybot-3.5.0}/cli/src/monkeybot_cli/scaffold_defaults/monkeybot.example.yaml

@@ -253,6 +253,17 @@ scheduler:
   # Env override: MONKEYBOT_SCHEDULER_ENABLED (1 | true | yes | on).
   enabled: false
 
+# Background verifier (YAML-only). Off by default: ledger costs one model call
+# per human message. `enabled: true` turns on omitted ledger/tracker flags;
+# omitted judge.enabled turns on only when the tracker is on. Explicit
+# `enabled: false` still opts a nested section out. Omitted ledger.model /
+# judge.model inherit model.name (same fallback as the agent). The live
+# worker is session-bound ProviderJudge. Realtime loops ignore this block.
+# verifier:
+#   enabled: true
+#   escalation:
+#     max_severity: nudge
+
 # Optional JSON for model.provider: fake tests (env: MONKEYBOT_FAKE_PROVIDER_EVENTS)
 # fake_provider:
 #   events_json: '[[]]'

{monkeybot-3.3.0 → monkeybot-3.5.0}/cli/tests/test_scaffold.py

@@ -34,6 +34,7 @@ def test_run_new_creates_bundle(tmp_path: Path) -> None:
     assert not (tmp_path / "skills" / "browser").exists()
     assert not (tmp_path / "skills" / "image-generator").exists()
     assert not (tmp_path / "skills" / "loop").exists()
+    assert (tmp_path / "skills" / "goal" / "SKILL.md").is_file()
     assert (tmp_path / "workspace" / ".gitkeep").is_file()
     assert (tmp_path / "workspace" / "browser" / "playbooks").is_dir()
     assert (tmp_path / "workspace" / "generated-media" / "images").is_dir()
@@ -153,6 +154,8 @@ def test_run_refresh_adds_template_commands_and_keeps_extras(tmp_path: Path) ->
     doc = yaml.safe_load(yaml_path.read_text(encoding="utf-8")) or {}
     doc.pop("memory", None)
     yaml_path.write_text(yaml.safe_dump(doc, sort_keys=False), encoding="utf-8")
+    goal_skill = tmp_path / "skills" / "goal" / "SKILL.md"
+    goal_skill.unlink()
 
     report = run_refresh(dest=tmp_path)
     text = allow.read_text(encoding="utf-8")
@@ -166,6 +169,7 @@ def test_run_refresh_adds_template_commands_and_keeps_extras(tmp_path: Path) ->
     refreshed_yaml = yaml_path.read_text(encoding="utf-8")
     assert "enabled: true" in refreshed_yaml
     assert "custom persona" not in refreshed_yaml
+    assert goal_skill.is_file()
     joined = "\n".join(report)
     assert "command_allowlist.yaml: updated" in joined
     assert "monkeybot.yaml: updated" in joined
@@ -174,7 +178,10 @@ def test_run_refresh_adds_template_commands_and_keeps_extras(tmp_path: Path) ->
 def test_run_refresh_skips_custom_permissions_and_model(tmp_path: Path) -> None:
     run_new(dest=tmp_path, force=False, provider="nvidia", model="keep-me")
     perms = tmp_path / "monkeybot_config" / "permissions.yaml"
-    perms.write_text("default: deny\nrules:\n  - tool: '*'\n    pattern: '*'\n    effect: deny\n", encoding="utf-8")
+    perms.write_text(
+        "default: deny\nrules:\n  - tool: '*'\n    pattern: '*'\n    effect: deny\n",
+        encoding="utf-8",
+    )
     yaml_path = tmp_path / "monkeybot_config" / "monkeybot.yaml"
     before = yaml_path.read_text(encoding="utf-8")
 

{monkeybot-3.3.0 → monkeybot-3.5.0}/docs/features.md

@@ -97,8 +97,10 @@ One **user message** may span multiple **inner turns** (model → tools → mode
 | Reply | `POST /sessions/{id}/reply` | Session idle | Starts a turn immediately (`SESSION_BUSY` if busy) |
 | Steer | `POST /sessions/{id}/steer` | Session busy | Injected after current tool batch / before next provider call |
 | Follow-up | `POST /sessions/{id}/queue` | Busy → enqueue; idle → start | FIFO drain after `TurnComplete` / lock release |
+| Promote | `POST /sessions/{id}/queue/{request_id}/steer` | A turn is live and the item is still queued. 409 `SESSION_IDLE` otherwise — promote is not meaningful between turns (including while a follow-up is waiting on the lock-retry path); those items drain automatically. | Atomic move from follow-up → steer; injected at the next inner-turn boundary. If the turn ends first, the item is restored to the front of the follow-up FIFO and starts its own turn. `QueuedInputAccepted.request_id` is the in-flight turn (same as `POST /steer`); the follow-up id is `UserSteered.queued_request_id`. |
+| Drop | `DELETE /sessions/{id}/queue/{request_id}` | Item still in the follow-up queue (or popped by drain but not yet started) | Removes it so it will not drain or promote |
 
-Do **not** conflate with HITL `ToolConfirmationRequest`. Cancel clears pending steer; follow-ups survive. Caps: `MONKEYBOT_STEER_QUEUE_MAX` (default 8), `MONKEYBOT_FOLLOW_UP_QUEUE_MAX` (default 16).
+Do **not** conflate with HITL `ToolConfirmationRequest`. Cancel clears pending steer; follow-ups survive (including follow-ups that had been promoted and not yet injected). Caps: `MONKEYBOT_STEER_QUEUE_MAX` (default 8), `MONKEYBOT_FOLLOW_UP_QUEUE_MAX` (default 16). `UserSteered.request_id` is always the in-flight turn; `queued_request_id` is set when the injected steer came from a promoted follow-up.
 
 **Process-local only:** steer/follow-up queues live on the in-process `SessionBus` (same constraint as the SSE registry). Multi-replica gateways do not share admission queues across instances — pin sticky sessions to one replica, or treat `/queue` as best-effort for single-process deployments. If drain cannot acquire the durable turn lock (another replica / stale claim), the item is requeued and retried on an interval (`MONKEYBOT_FOLLOW_UP_LOCK_RETRY_S`, default 1s) until the lock frees or the wait budget expires (`MONKEYBOT_FOLLOW_UP_LOCK_WAIT_MS`, default = session-turn stale window), after which that follow-up is dropped so the queue cannot wedge forever.
 
@@ -657,7 +659,7 @@ Before spawning the gateway, the CLI probes that interpreter for MonkeyBot `>=3.
 
 **How it works:**
 - Off by default, macOS-only: `computer.enabled: true` in `monkeybot.yaml` → `MONKEYBOT_COMPUTER_TOOLS` env, combined with a hard `sys.platform == "darwin"` check (`should_enable_computer_tools()`). The desktop app sets the env var when it spawns a gateway with the feature turned on in Settings; no other deployment should ever set it.
-- **Hard security boundary lives in the tool bodies, not in `permissions.yaml`** (`safety.py`): every path is resolved and validated against the user's home directory after following symlinks; a fixed denylist blocks credential directories (`.ssh`, `.aws`, keychains, browser profiles, the app's own config) both at their canonical location *and* by directory-name anywhere in the tree; filenames matching credential patterns (`.env`, `*.pem`, `id_rsa*`, …) are always refused; `computer_open` refuses any path/app that would make `open` execute code (`.command`, `.app`, `.sh`, Terminal, script editors, …); trash never hard-deletes. `permissions.yaml` is fail-open (a broken file silently disables it), so none of this can depend on it. `_denied_dirs()` also always includes `MONKEYBOT_WORKSPACE_ROOT` (not only under `MONKEYBOT_APP_HOME`, which only the desktop app sets) — a CLI-scaffolded agent's workspace can sit anywhere under `$HOME` the user chose, and `computer_move`/`computer_trash` must not be able to relocate a file straight into or out of it, one click away from smuggling exactly what the workspace boundary (§4) exists to prevent. `computer_move`'s own description now says so, so the model doesn't reach for it as a `read_file`/`run_command` workaround.
+- **Hard security boundary lives in the tool bodies, not in `permissions.yaml`** (`safety.py`): every path is resolved and validated against the user's home directory after following symlinks; a fixed denylist blocks credential directories (`.ssh`, `.aws`, keychains, browser profiles, the app's own config) both at their canonical location *and* by directory-name anywhere in the tree; filenames matching credential patterns (`.env`, `*.pem`, `id_rsa*`, …) are always refused; `computer_open` refuses any path/app that would make `open` execute code (`.command`, `.app`, `.sh`, Terminal, script editors, …); trash never hard-deletes. `permissions.yaml` is fail-open (a broken file silently disables it), so none of this can depend on it. `_denied_dirs()` also always includes `MONKEYBOT_WORKSPACE_ROOT` (not only under `MONKEYBOT_APP_HOME`, which only the desktop app sets) — a CLI-scaffolded agent's workspace can sit anywhere under `$HOME` the user chose. Destinations and `computer_trash` still cannot write into it. A workspace *source* may be copied (not moved) out only when it is a generated document (PDF, images, office files); `computer_open` of workspace exec surfaces (`.terminal`, `.webloc`, `.fileloc`, …) is denied. `computer_move`'s own description now says so, so the model doesn't reach for it as a `read_file`/`run_command` workaround.
 - **Every `computer_*` call asks by default**, via a built-in baseline rule (`COMPUTER_BASELINE_RULES` in `permissions.py`) — not a line in `permissions.yaml`, so it can't be silently defeated by a missing/broken config file. `ComputerAwarePermissionInspector` layers, last-match-wins: baseline `ask` < durable approvals overlay `allow` < the user's `permissions.yaml` (highest authority — a hand-written `deny` always wins).
 - **"Always allow" is durable and narrow**: `monkeybot_config/approvals.json` (machine-written, JSON — deliberately *not* appended into `permissions.yaml`, which is a comment-heavy file the app's Advanced settings save wholesale) stores one exact `(tool, resource)` pair per rule. Mutating tools (`computer_move`, `computer_trash`) are excluded from `ALWAYS_SCOPE` — their resource is the *source* path only, so an "always" rule would cover any destination — every call to them asks. The inspector re-`stat`s the overlay file on every check and reloads on change; on a genuine change it also clears the session-level approval cache, so a revoke in the app's Settings takes effect immediately rather than waiting for a gateway restart.
 - Registered via the standard `extra_tools` extension point in both the SSE (`gateway/sse/app.py`) and realtime (`gateway/realtime/routes.py`) gateways — same mechanism as `web_search`/`todo_list`. Never registered for subagents (`subagent_worker.py` builds its own `extra_tools` independently and never imports this package).

{monkeybot-3.3.0 → monkeybot-3.5.0}/docs/sse-gateway-ui.md

@@ -104,7 +104,8 @@ Common types you will handle in a chat UI:
 | `ToolCallStarted` / `ToolCallResult` | Tool name, args, result text / error. |
 | `TurnComplete` | Turn finished; includes `usage` (`input_tokens`, `output_tokens`, `cached_tokens`, `cost_usd`, `duration_ms`, `estimated_prompt_tokens` — see [Session usage endpoint](#session-usage-endpoint)). |
 | `Error` | Recoverable stream error string in `error`. |
-| `ImageBlock` | Inline image (`mime_type`, base64 `data`). |
+| `ImageBlock` | Inline image (`mime_type`, workspace `path`, or base64 `data` when no path). |
+| `FileBlock` | Generated document (`mime_type`, workspace `path`, `filename`, `file_id`). Path-only — clients load from disk; raw PDF bytes are never sent on the wire. |
 | `ThinkingBlockDelta` / `ThinkingBlockComplete` / `RedactedThinkingBlock` | Extended thinking blocks where the model exposes them. |
 | `ToolConfirmationRequest` | User must approve/deny; POST to `tool-confirmations` with `tool_call_id`. Carries `tool_name`, `arguments` (the tool's raw call args — e.g. `path`/`url`/`app` for `computer_*` tools, useful for showing *what* is being approved), and an optional human-readable `prompt`. The reference Textual client can auto-answer these client-side in `auto-approve`/`deny-confirms` mode (`Shift+Tab` in `monkeybot chat`) — this is purely a UI convenience, no gateway change; `ActionRequiredEvent` elicitations are never auto-answered. |
 | `ActionRequiredEvent` | e.g. `action_type: "elicitation"` with `id` and `payload`; POST to `elicitations/{id}`. |

{monkeybot-3.3.0 → monkeybot-3.5.0}/docs/verifier-agent-design.md

@@ -70,8 +70,9 @@ A new session should read this section, then Part 8. Phases 0–6 are in the tre
 - `NudgeActuator` on `PRE_TOOL`; drain caps severity and stashes one nudge.
 - `tail_grace_s` on the turn-tail drain only, and only while the judge has a call in flight
   (`mailbox.pending`) — an idle turn never pays the grace.
-- Nudge/replan notes are request-scoped (`put_nudge`/`take_nudge` take a `request_id`): a note
-  whose request has already finished is dropped, not applied to the next user message.
+- Sticky nudges (`activate_nudge`/`peek_nudge`) and replan notes (`put_replan`/`take_replan`)
+  are request-scoped: a note whose request has already finished is dropped, not applied to
+  the next user message.
 - Judge rate limits are charged at `enqueue` and refunded when no verdict lands, so a slow port
   cannot slip past `max_verdicts_per_message` while a call is in flight.
 - Tests: `tests/core/test_progress_tracker.py` (`test_nudge_reaches_next_system_message_once`), `tests/evals/test_verifier_port.py`.
@@ -725,16 +726,16 @@ New `verifier:` block in `monkeybot.yaml`, defaulted off. The section is **YAML-
 verifier:
   enabled: false               # master switch; when false, NOTHING below runs
   ledger:
-    enabled: false             # one classifier call per human input when on
-    model: gemini-2.5-flash    # classifier; see Open decision 2
+    enabled: false             # omitted → follows verifier.enabled
+    # model:                   # omitted / null → inherit model.name (then gemini-2.5-flash)
     max_entries_per_thread: 64
   tracker:
-    enabled: false             # requires ledger.enabled for constraint signals
+    enabled: false             # omitted → follows verifier.enabled
     suspicion_threshold: 3
     min_turn_before_verdict: 3
   judge:
-    enabled: false             # requires tracker.enabled
-    model: gemini-2.5-flash    # small + fast; not the main agent's model
+    enabled: false             # omitted → on only when parent and tracker are on
+    # model:                   # reserved; SignalJudge ignores it today
     max_verdicts_per_message: 3
     min_turns_between_verdicts: 2
     max_spend_ratio: 0.25      # of main-agent tokens for this message
@@ -743,16 +744,18 @@ verifier:
     max_severity: nudge        # nudge | replan | steer | block
 ```
 
-**Gating is explicit and hierarchical.** Precedence, highest first:
+**Gating is hierarchical.** Precedence, highest first:
 
 1. **`verifier.enabled` is the master switch.** When `false`, nothing below runs — not the ledger, not the tracker, not the judge, and not actuation — regardless of child `enabled` flags or `escalation.max_severity`. That is the one switch an operator needs to turn the whole feature off.
-2. **Child `enabled` flags** (`ledger`, `tracker`, `judge`) only apply when the master switch is on. A child set `true` while the master is `false` is a no-op, not an override.
-3. **`judge` requires `tracker`.** `tracker` without `ledger` runs only the ledger-independent signals (`error_streak`, `no_progress`, `write_without_read`, `budget_burn`, `rewrite_churn`). `ledger` can run alone (Phase 1 ships this way).
+2. **When the master is on, omitted child `enabled` flags inherit on** for `ledger` and `tracker`. Omitted `judge.enabled` inherits on only if the tracker is on. Explicit `enabled: false` still opts a nested section out. A child set `true` while the master is `false` is a no-op, not an override.
+3. **`judge` requires `tracker` at runtime.** `build_verifier` skips an explicit `judge.enabled: true` when the tracker is off and logs that skip. `tracker` without `ledger` runs only the ledger-independent signals (`error_streak`, `no_progress`, `write_without_read`, `budget_burn`, `rewrite_churn`). `ledger` can run alone (Phase 1 ships this way).
 4. **`escalation.max_severity` caps actuation, it does not enable anything.** `enabled: true` plus `max_severity: none` is "on but muted": observe/record verdicts at `none`, never nudge/replan/steer/block. Raising the cap cannot turn on a disabled child. The smoke fixture `evals/smoke_agent/monkeybot_config/monkeybot.verifier-on.yaml` uses this shape on purpose.
 
 The parser does not rewrite child flags when the master is off; readers must check `verifier.enabled` first. `max_severity` values are `none | nudge | replan | steer | block` in that rank order (`VERIFIER_SEVERITY_ORDER` in `core/config/settings.py`). `steer` is reserved for a later optional phase; Phases 4–6 ship nudge/replan/block.
 
-The ledger's default is `false` because it is the only sub-feature with a per-message model cost even when nothing is being verified.
+The dataclass default for every nested `enabled` is still `false` so an absent `verifier:` section stays off. The inheritance rule above is the upgrade hazard: an existing file that set only `verifier.enabled: true` plus `ledger.enabled: true` now also gets the tracker (and the judge if the tracker stays on). Opt out with `tracker.enabled: false` / `judge.enabled: false`.
+
+Omitted `ledger.model` / `judge.model` resolve through `effective_verifier_model` — the same `model.name` / `MODEL_NAME` / `gemini-2.5-flash` chain as `get_provider_config`. `judge.model` is reserved; today's worker is the deterministic `SignalJudge`.
 
 **Plumbing is a typed snapshot field, not an env map.** Mirror `subagents:`:
 

{monkeybot-3.3.0 → monkeybot-3.5.0}/integrations/browser-mcp/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "monkeybot-browser-mcp"
-version = "0.7.0"
+version = "0.7.2"
 description = "monkeybot MCP server wrapping browser-harness for real-browser control and site playbooks."
 requires-python = ">=3.11"
 dependencies = [

{monkeybot-3.3.0 → monkeybot-3.5.0}/integrations/browser-mcp/src/browser_mcp/app.py

@@ -151,7 +151,10 @@ def prepare_action(
         )
     except tabs.UnknownTabError as exc:
         return PreparedAction(error=results.unknown_tab_result(exc), mode=mode)
-    before_url = str(handle.page_info().get("url") or "") if capture_url else ""
+    before_url = ""
+    if capture_url:
+        info = handle.page_info()
+        before_url = str(info.get("url") or "") if isinstance(info, dict) else ""
     return PreparedAction(
         error=None, helpers=helpers, handle=handle, mode=mode, before_url=before_url
     )

{monkeybot-3.3.0 → monkeybot-3.5.0}/integrations/browser-mcp/src/browser_mcp/tab_ops.py

@@ -76,8 +76,30 @@ def _close_target(helpers: Any, target_id: str) -> None:
     raise tabs.SingleTabBackendError()
 
 
+def _blank_target_id(helpers: Any) -> str | None:
+    """Reuse the focused about:blank tab instead of stacking a New tab."""
+    if not callable(getattr(helpers, "current_tab", None)):
+        return None
+    try:
+        row = helpers.current_tab()
+    except Exception:
+        logger.debug("current_tab failed while looking for a blank tab", exc_info=True)
+        return None
+    if not isinstance(row, dict):
+        return None
+    if not actions._is_blank_url(str(row.get("url") or "")):
+        return None
+    tid = row.get("targetId") or row.get("target_id")
+    return str(tid) if tid else None
+
+
 def _create_blank_target(helpers: Any, *, focus: bool, url: str = "about:blank") -> bool:
     """Create a tab. Returns True if ``url`` was already loaded by the helper."""
+    existing = _blank_target_id(helpers)
+    if existing:
+        if focus:
+            helpers.switch_tab(existing)
+        return actions._is_blank_url(url)
     if callable(getattr(helpers, "cdp", None)):
         try:
             result = helpers.cdp(

{monkeybot-3.3.0 → monkeybot-3.5.0}/integrations/browser-mcp/src/browser_mcp/tabs.py

@@ -19,7 +19,9 @@ from typing import Any
 
 _ALIAS_RE = re.compile(r"^[a-z][a-z0-9_-]{0,23}$")
 _CHROME_INTERNAL = ("chrome://", "chrome-untrusted://", "devtools://", "chrome-extension://")
-_SESSION_LOST = "session with given id"
+# Chrome: "Session with given id not found". Monkeyapp's flatten CDP bridge:
+# "unknown session" when the harness still holds a detached sessionId.
+_SESSION_GONE_MARKERS = ("session with given id", "unknown session")
 logger = logging.getLogger(__name__)
 _SINGLE_TAB_MARKERS = (
     "not allowed",
@@ -96,8 +98,18 @@ def _has_helper(helpers: Any, name: str) -> bool:
     return callable(getattr(helpers, name, None))
 
 
+def _message_has_marker(exc: BaseException, markers: tuple[str, ...]) -> bool:
+    text = str(exc).lower()
+    return any(marker in text for marker in markers)
+
+
 def _session_gone(exc: BaseException) -> bool:
-    return _SESSION_LOST in str(exc).lower()
+    return _message_has_marker(exc, _SESSION_GONE_MARKERS)
+
+
+def is_missing_page_error(exc: BaseException) -> bool:
+    """True when CDP has no live page (empty tabs). Fail-closed on unknown session."""
+    return "no page target" in str(exc).lower()
 
 
 def _log_detach_failure(session_id: str, exc: BaseException) -> None:
@@ -271,19 +283,25 @@ class TabHandle:
         return self.helpers.goto_url(url, target_id=self.state.target_id)
 
     def page_info(self) -> dict[str, Any]:
-        if self.focused or self.state is None:
-            info = self.helpers.page_info()
-            return info if isinstance(info, dict) else {}
-        raw = self.evaluate(_PAGE_INFO_JS)
-        if isinstance(raw, dict):
-            return raw
-        if isinstance(raw, str):
-            try:
-                parsed = json.loads(raw)
-            except json.JSONDecodeError:
+        try:
+            if self.focused or self.state is None:
+                info = self.helpers.page_info()
+                return info if isinstance(info, dict) else {}
+            raw = self.evaluate(_PAGE_INFO_JS)
+            if isinstance(raw, dict):
+                return raw
+            if isinstance(raw, str):
+                try:
+                    parsed = json.loads(raw)
+                except json.JSONDecodeError:
+                    return {}
+                return parsed if isinstance(parsed, dict) else {}
+            return {}
+        except Exception as exc:
+            if is_missing_page_error(exc):
+                logger.debug("page_info: no live page yet", exc_info=True)
                 return {}
-            return parsed if isinstance(parsed, dict) else {}
-        return {}
+            raise
 
     def capture_screenshot(
         self, path: str | None = None, full: bool = False, max_dim: int | None = None

{monkeybot-3.3.0 → monkeybot-3.5.0}/integrations/browser-mcp/tests/test_act.py

@@ -119,6 +119,36 @@ def test_act_stop_on_error_returns_completed_and_observation() -> None:
     assert result["observation"]["mode"] in {"diff", "full"}
 
 
+def test_act_goto_opens_tab_when_page_info_has_no_page() -> None:
+    """Empty in-app browser must not abort act/goto."""
+    helpers = MagicMock()
+    helpers.list_tabs.return_value = []
+    helpers.current_tab.return_value = None
+    helpers.js.return_value = True
+
+    def page_info() -> dict[str, str]:
+        if helpers.new_tab.called:
+            return {"url": "https://a.test/", "title": "A", "w": "800", "h": "600"}
+        raise RuntimeError("no page target")
+
+    helpers.page_info.side_effect = page_info
+    with (
+        _patch_harness(helpers),
+        patch.object(dom_indexing, "settle", return_value={"quiet": True, "navigated": False}),
+        patch.object(dom_indexing, "_register_driver_for_new_documents"),
+        patch.object(dom_indexing, "get_elements") as get_elements,
+    ):
+        result = json.loads(
+            server.browser_act(
+                [{"do": "goto", "url": "https://a.test/"}],
+                observe="none",
+            )
+        )
+    assert result["ok"] is True
+    helpers.new_tab.assert_called_once_with("https://a.test/")
+    get_elements.assert_not_called()
+
+
 def test_act_observe_none_skips_snapshot() -> None:
     helpers = _helpers()
     with (

{monkeybot-3.3.0 → monkeybot-3.5.0}/integrations/browser-mcp/tests/test_playbook_flows.py

@@ -144,6 +144,46 @@ def test_list_playbooks_includes_flows() -> None:
     assert listed["flows"] == [{"host": "a.test", "name": "signup", "params": ["nickname"]}]
 
 
+def test_run_playbook_opens_tab_when_page_info_has_no_page() -> None:
+    playbooks.write_playbook("a.test", _SIGNUP)
+    helpers = MagicMock()
+    helpers.list_tabs.return_value = []
+    helpers.current_tab.return_value = None
+    helpers.js.return_value = True
+
+    def page_info() -> dict[str, str]:
+        if helpers.new_tab.called:
+            return {"url": "https://a.test/form.html", "title": "A"}
+        raise RuntimeError("no page target")
+
+    helpers.page_info.side_effect = page_info
+    with (
+        _patch_harness(helpers),
+        patch.object(dom_indexing, "settle", return_value={"quiet": True, "navigated": False}),
+        patch.object(dom_indexing, "_register_driver_for_new_documents"),
+        patch.object(
+            actions,
+            "do_fill_form",
+            return_value={
+                "ok": True,
+                "filled": [{"label": "Nickname", "index": 1, "how": "label_for"}],
+                "unresolved": [],
+                "submitted": True,
+            },
+        ),
+        patch.object(playbooks, "check_expect", return_value=None),
+    ):
+        result = json.loads(
+            server.browser_run_playbook(
+                "a.test", "signup", {"nickname": "ada"}, observe="none"
+            )
+        )
+    assert result["ok"] is True
+    helpers.new_tab.assert_called_once_with("https://a.test/form.html")
+    assert result["name"] == "signup"
+    assert len(result["completed"]) == 2
+
+
 def test_run_playbook_success_and_expect() -> None:
     playbooks.write_playbook("a.test", _SIGNUP)
     helpers = _helpers()

{monkeybot-3.3.0 → monkeybot-3.5.0}/integrations/browser-mcp/tests/test_tabs.py

@@ -149,6 +149,27 @@ def test_user_opened_untouched_tabs_do_not_count_toward_cap(
     )
 
 
+def test_open_tab_reuses_focused_blank_instead_of_creating() -> None:
+    helpers = _helpers(tabs_list=[_tab("blank", "about:blank")], focused="blank")
+    helpers.cdp = MagicMock()
+
+    def goto_url(url: str, **_k: object) -> str:
+        helpers.current_tab.return_value = _tab("blank", url)
+        helpers.page_info.return_value = {"url": url, "title": "t", "w": 800, "h": 600}
+        return url
+
+    helpers.goto_url.side_effect = goto_url
+    with _patch_harness(helpers):
+        json.loads(server.browser_tabs())
+        result = json.loads(server.browser_open_tab("https://ex.test/new"))
+    assert result["ok"] is True
+    assert result["url"] == "https://ex.test/new"
+    assert all(
+        not (c.args and c.args[0] == "Target.createTarget")
+        for c in helpers.cdp.call_args_list
+    )
+
+
 def test_close_tab_then_retry_succeeds(monkeypatch: pytest.MonkeyPatch) -> None:
     monkeypatch.setenv("BROWSER_MCP_MAX_TABS", "1")
     user = _tab("user", "https://user.test/")
@@ -208,6 +229,49 @@ def test_browser_stop_closes_agent_opened_tabs_at_cap(
     assert helpers.close_tab.call_count == 5
 
 
+def test_session_for_reattaches_on_unknown_session() -> None:
+    helpers = MagicMock()
+    helpers.cdp.side_effect = [
+        {"sessionId": "sid-1"},
+        {},
+        {},
+        RuntimeError("{'code': -32000, 'message': 'unknown session'}"),
+        {"sessionId": "sid-2"},
+        {},
+        {},
+        {"result": {"type": "string", "value": "ok"}},
+    ]
+    state = TabState(target_id="aaa", tab="t1", alias="t1")
+    tabs.reset_registry()
+    tabs.registry()._tabs["aaa"] = state
+    tabs.registry()._aliases["t1"] = "aaa"
+    handle = tabs.TabHandle(helpers, state, focused=False)
+    assert handle.evaluate("1+1") == "ok"
+    methods = [c.args[0] for c in helpers.cdp.call_args_list]
+    assert methods.count("Target.attachToTarget") == 2
+    assert state.session_id == "sid-2"
+
+
+def test_focused_page_info_returns_empty_on_no_page() -> None:
+    helpers = MagicMock()
+    helpers.page_info.side_effect = RuntimeError("no page target")
+    handle = tabs.TabHandle(helpers, None, focused=True)
+    assert handle.page_info() == {}
+    assert tabs.is_missing_page_error(RuntimeError("no page target"))
+    assert not tabs.is_missing_page_error(RuntimeError("unknown session"))
+    assert not tabs.is_missing_page_error(RuntimeError("tab sealed"))
+
+
+def test_focused_page_info_raises_on_unknown_session() -> None:
+    helpers = MagicMock()
+    helpers.page_info.side_effect = RuntimeError(
+        "{'code': -32000, 'message': 'unknown session'}"
+    )
+    handle = tabs.TabHandle(helpers, None, focused=True)
+    with pytest.raises(RuntimeError, match="unknown session"):
+        handle.page_info()
+
+
 def test_session_for_attaches_once_and_reattaches_on_lost_session() -> None:
     helpers = MagicMock()
     helpers.cdp.side_effect = [

{monkeybot-3.3.0 → monkeybot-3.5.0}/integrations/browser-mcp/uv.lock

@@ -484,7 +484,7 @@ wheels = [
 
 [[package]]
 name = "monkeybot-browser-mcp"
-version = "0.7.0"
+version = "0.7.1"
 source = { editable = "." }
 dependencies = [
     { name = "browser-harness" },