monkeybot 3.5.0__tar.gz → 3.6.1__tar.gz

{monkeybot-3.5.0 → monkeybot-3.6.1}/CHANGELOG.md

@@ -6,6 +6,25 @@ the project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [core v3.6.1] - 2026-09-26
+
+### Fixed
+
+- `run_command`'s macOS jail can launch onefile binaries that live under the home directory. Bundled `yt-dlp` needs to read its own executable and create a SysV semaphore; both were denied, so `/watch-video` died before any download.
+- `run_command` can read an installed on-device Whisper model under the home directory, so `/watch-video` can transcribe with it.
+
+## [cli v0.8.0] - 2026-09-21
+
+#### Added
+
+- `monkeybot chat` prompts for an `ask_user` question and posts the reply to the gateway.
+
+## [core v3.6.0] - 2026-09-21
+
+#### Added
+
+- `ask_user` asks the user a question, with an optional list of two to six choices, and waits for the posted answer before the tool returns.
+
 ## [core v3.5.0] - 2026-09-20
 
 ### Added

{monkeybot-3.5.0 → monkeybot-3.6.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: monkeybot
-Version: 3.5.0
+Version: 3.6.1
 Summary: monkeybot agent harness — FastAPI SSE gateway, owned loop, SQLite, and MCP.
 License: MIT
 License-File: LICENSE

{monkeybot-3.5.0 → monkeybot-3.6.1}/cli/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "monkeybot-cli"
-version = "0.7.0"
+version = "0.8.0"
 description = "CLI to create, configure, validate, and chat with monkeybot agents."
 requires-python = ">=3.11"
 dependencies = [

{monkeybot-3.5.0 → monkeybot-3.6.1}/cli/src/monkeybot_cli/chat_session.py

@@ -16,6 +16,7 @@ from typing import Any, Literal
 import httpx
 from monkeybot.core.runtime.events import (
     ActionRequiredEvent,
+    AskUserRequestEvent,
     AssistantDelta,
     ContextSummarized,
     ContextSummarizing,
@@ -41,7 +42,12 @@ HitlReaderFn = Callable[["HitlRequest"], Any]  # async (HitlRequest) -> HitlAnsw
 
 HitlKind = Literal["confirm", "elicit", "frontend_unsupported"]
 
-_HITL_TYPES = (ToolConfirmationRequestEvent, ActionRequiredEvent, FrontendToolRequestEvent)
+_HITL_TYPES = (
+    ToolConfirmationRequestEvent,
+    AskUserRequestEvent,
+    ActionRequiredEvent,
+    FrontendToolRequestEvent,
+)
 
 _RECONNECT_INITIAL_DELAY = 0.5
 _RECONNECT_MAX_DELAY = 15.0
@@ -717,6 +723,9 @@ class ChatSessionController:
         if isinstance(evt, ToolConfirmationRequestEvent):
             await self._handle_tool_confirm(evt)
             return
+        if isinstance(evt, AskUserRequestEvent):
+            await self._handle_ask_user(evt)
+            return
         if isinstance(evt, ActionRequiredEvent):
             await self._handle_elicit(evt)
 
@@ -753,6 +762,32 @@ class ChatSessionController:
         if answer.cancelled or not ok:
             self._turn_abort.set()
 
+    async def _handle_ask_user(self, evt: AskUserRequestEvent) -> None:
+        assert self.session_id is not None
+        choices = "\n".join(f"- {choice}" for choice in evt.choices)
+        prompt = evt.question or "The agent asked a question."
+        if choices:
+            prompt = f"{prompt}\n{choices}"
+        answer = await self._await_hitl(
+            HitlRequest(
+                kind="elicit",
+                prompt=prompt,
+                tool_call_id=evt.tool_call_id,
+                tool_name="ask_user",
+            )
+        )
+        text = "" if answer.cancelled else answer.text.strip()
+        if not text:
+            self.abort_turn()
+            return
+        ok = await self._post_hitl(
+            f"{self.base}/sessions/{self.session_id}/ask-user/{evt.tool_call_id}",
+            {"answer": text},
+            label="Ask user",
+        )
+        if not ok:
+            self.abort_turn()
+
     async def _handle_elicit(self, evt: ActionRequiredEvent) -> None:
         assert self.session_id is not None
         payload = dict(evt.payload) if evt.payload else {}

{monkeybot-3.5.0 → monkeybot-3.6.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "monkeybot"
-version = "3.5.0"
+version = "3.6.1"
 description = "monkeybot agent harness — FastAPI SSE gateway, owned loop, SQLite, and MCP."
 requires-python = ">=3.11"
 readme = "README.md"

{monkeybot-3.5.0 → monkeybot-3.6.1}/src/monkeybot/core/context/__init__.py

@@ -691,6 +691,32 @@ def _core_tool_defs(
         "required": ["task"],
     }
     tools: list[ToolDef] = [
+        ToolDef(
+            "ask_user",
+            (
+                "Ask the user a question and wait for their answer. Call this when you "
+                "need a decision before you can continue. Pass choices when a short list "
+                "of answers would help. Call it once, then wait. Do not invent the answer."
+            ),
+            {
+                "type": "object",
+                "properties": {
+                    "question": {
+                        "type": "string",
+                        "minLength": 1,
+                        "description": "The question to show the user.",
+                    },
+                    "choices": {
+                        "type": "array",
+                        "minItems": 2,
+                        "maxItems": 6,
+                        "items": {"type": "string", "minLength": 1},
+                        "description": "Optional distinct answers the user can pick.",
+                    },
+                },
+                "required": ["question"],
+            },
+        ),
         ToolDef(
             "run_command",
             (

{monkeybot-3.5.0 → monkeybot-3.6.1}/src/monkeybot/core/runtime/events.py

@@ -190,6 +190,15 @@ class ToolConfirmationRequestEvent:
     prompt: str | None = None
 
 
+@dataclass(frozen=True)
+class AskUserRequestEvent:
+    kind: Literal["AskUserRequest"] = "AskUserRequest"
+    request_id: str = ""
+    tool_call_id: str = ""
+    question: str = ""
+    choices: tuple[str, ...] = ()
+
+
 @dataclass(frozen=True)
 class ActionRequiredEvent:
     kind: Literal["ActionRequiredEvent"] = "ActionRequiredEvent"
@@ -469,6 +478,7 @@ AgentEvent: TypeAlias = (
     | ThinkingBlockComplete
     | RedactedThinkingBlock
     | ToolConfirmationRequestEvent
+    | AskUserRequestEvent
     | ActionRequiredEvent
     | FrontendToolRequestEvent
     | SystemNotificationEvent
@@ -697,6 +707,13 @@ def _story5_event_dict(event: AgentEvent) -> dict[str, object]:
             "arguments": dict(event.arguments),
             "prompt": event.prompt,
         }
+    if isinstance(event, AskUserRequestEvent):
+        return {
+            **base,
+            "tool_call_id": event.tool_call_id,
+            "question": event.question,
+            "choices": list(event.choices),
+        }
     if isinstance(event, ActionRequiredEvent):
         return {
             **base,
@@ -877,6 +894,7 @@ def event_to_json(event: AgentEvent) -> str:
             ThinkingBlockComplete,
             RedactedThinkingBlock,
             ToolConfirmationRequestEvent,
+            AskUserRequestEvent,
             ActionRequiredEvent,
             FrontendToolRequestEvent,
             SystemNotificationEvent,
@@ -1097,6 +1115,20 @@ def _event_from_dict(payload: dict[str, Any]) -> AgentEvent:
             arguments=arguments,
             prompt=prompt,
         )
+    if t == "AskUserRequest":
+        call_raw = payload.get("tool_call_id", "")
+        question_raw = payload.get("question", "")
+        choices_raw = payload.get("choices", [])
+        if not isinstance(call_raw, str) or not isinstance(question_raw, str):
+            raise EventDecodeError("AskUserRequest fields must be strings")
+        if not isinstance(choices_raw, list) or any(not isinstance(item, str) for item in choices_raw):
+            raise EventDecodeError("AskUserRequest choices must be a list of strings")
+        return AskUserRequestEvent(
+            request_id=rid,
+            tool_call_id=call_raw,
+            question=question_raw,
+            choices=tuple(choices_raw),
+        )
     if t == "ActionRequiredEvent":
         at_raw = payload.get("action_type", "elicitation")
         if at_raw not in ("elicitation", "toolConfirmation", "elicitationResponse"):

monkeybot-3.6.1/src/monkeybot/core/tools/ask_user.py

@@ -0,0 +1,75 @@
+"""ask_user: a structured question the host answers before the tool returns."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from monkeybot.core.runtime.events import AskUserRequestEvent, event_to_json
+
+_MAX_QUESTION = 2_000
+_MAX_CHOICE = 160
+_MIN_CHOICES = 2
+_MAX_CHOICES = 6
+
+
+def parse_ask_user_args(args: dict[str, Any]) -> tuple[str, tuple[str, ...]] | str:
+    """Return ``(question, choices)`` or an error string."""
+    raw_question = args.get("question")
+    question = raw_question.strip() if isinstance(raw_question, str) else ""
+    if not question:
+        return "ask_user requires a non-empty question"
+    if len(question) > _MAX_QUESTION:
+        question = question[:_MAX_QUESTION]
+    raw_choices = args.get("choices")
+    if raw_choices is None:
+        return question, ()
+    if not isinstance(raw_choices, list):
+        return "ask_user choices must be a list of strings"
+    choices: list[str] = []
+    for item in raw_choices:
+        if not isinstance(item, str) or not item.strip():
+            return "ask_user choices must be non-empty strings"
+        text = item.strip()
+        if len(text) > _MAX_CHOICE:
+            return "ask_user choices must be short"
+        if text in choices:
+            return "ask_user choices must be unique"
+        choices.append(text)
+    if len(choices) < _MIN_CHOICES or len(choices) > _MAX_CHOICES:
+        return f"ask_user choices must include {_MIN_CHOICES} to {_MAX_CHOICES} options"
+    return question, tuple(choices)
+
+
+async def await_ask_user_answer(
+    bus: Any,
+    *,
+    call_id: str,
+    request_id: str,
+    question: str,
+    choices: tuple[str, ...],
+) -> str | None:
+    """Publish the question and wait until the host posts an answer.
+
+    Returns the answer, or ``None`` when this session cannot ask.
+    ``asyncio.CancelledError`` propagates when the turn is stopped.
+    """
+    publish = getattr(bus, "publish_data", None)
+    register = getattr(bus, "register_pending", None)
+    if publish is None or register is None or not call_id:
+        return None
+    fut = register(call_id)
+    await publish(
+        event_to_json(
+            AskUserRequestEvent(
+                request_id=request_id,
+                tool_call_id=call_id,
+                question=question,
+                choices=choices,
+            )
+        )
+    )
+    payload = await fut
+    if not isinstance(payload, dict):
+        return ""
+    answer = payload.get("answer")
+    return answer.strip() if isinstance(answer, str) else ""

{monkeybot-3.5.0 → monkeybot-3.6.1}/src/monkeybot/core/tools/core_tool_executor.py

@@ -96,7 +96,13 @@ from monkeybot.core.subprocess_groups import (
     process_group_id,
     stop_subagent_process,
 )
-from monkeybot.core.tools.fs_isolation import JailRoots, memory_hidden_paths
+from monkeybot.core.tools.ask_user import await_ask_user_answer, parse_ask_user_args
+from monkeybot.core.tools.fs_isolation import (
+    JailRoots,
+    local_whisper_model_dirs,
+    memory_hidden_paths,
+    readable_bin_dirs_under_deny,
+)
 from monkeybot.core.tools.grant_store import PATH_GRANT_TOOLS, GrantStoreCache
 from monkeybot.core.tools.inspector import parse_run_command
 from monkeybot.core.tools.sandbox_executor import SandboxConfig, SandboxExecutor
@@ -159,6 +165,7 @@ _CORE_TOOL_NAMES = frozenset(
         "stop_loop",
         "create_goal",
         "update_goal",
+        "ask_user",
     }
 )
 
@@ -1173,6 +1180,8 @@ class CoreToolExecutor(ToolExecutorPort):
                 result_text, err_text = await self._tool_create_goal(args, ctx)
             elif name == "update_goal":
                 result_text, err_text = await self._tool_update_goal(args, ctx)
+            elif name == "ask_user":
+                result_text, err_text = await self._tool_ask_user(args, call, ctx)
             elif name in self._extra_tools:
                 try:
                     raw = await self._extra_tools[name].execute(args)
@@ -1920,8 +1929,11 @@ class CoreToolExecutor(ToolExecutorPort):
         a sibling of the workspace, not under it), OS temp dirs (read+write,
         many toolchains stage there), skills and the interpreter's own
         install prefix (read-only — the interpreter can live under $HOME for
-        a bundled desktop app), and any folder the user has granted read
-        access to, durably or for this turn (read-only).
+        a bundled desktop app), PATH ``bin`` directories that sit inside the
+        denied home (read-only — onefile tools such as bundled ``yt-dlp``
+        have to read their own executable), an installed on-device Whisper
+        model directory (read-only), and any folder the user has
+        granted read access to, durably or for this turn (read-only).
         """
         read_write: list[Path] = [self._workspace.repo_root]
         if self._artifacts_path is not None:
@@ -1954,6 +1966,8 @@ class CoreToolExecutor(ToolExecutorPort):
         deny: list[Path] = []
         with contextlib.suppress(RuntimeError):
             deny.append(Path.home())
+        read_only.extend(readable_bin_dirs_under_deny(deny))
+        read_only.extend(local_whisper_model_dirs(deny=deny))
 
         return JailRoots(
             read_write=tuple(dict.fromkeys(p.resolve() for p in read_write)),
@@ -2508,3 +2522,26 @@ class CoreToolExecutor(ToolExecutorPort):
             ),
             None,
         )
+
+    async def _tool_ask_user(
+        self, args: dict[str, Any], call: ToolCall, ctx: TurnContext
+    ) -> tuple[str | None, str | None]:
+        parsed = parse_ask_user_args(args)
+        if isinstance(parsed, str):
+            return (None, parsed)
+        question, choices = parsed
+        bus = ctx.sse_bus
+        if bus is None:
+            return (None, "ask_user is only available in an interactive chat")
+        answer = await await_ask_user_answer(
+            bus,
+            call_id=call.call_id,
+            request_id=ctx.request_id,
+            question=question,
+            choices=choices,
+        )
+        if answer is None:
+            return (None, "ask_user is only available in an interactive chat")
+        if not answer:
+            return (None, "ask_user received an empty answer")
+        return (_j({"answer": answer}), None)

{monkeybot-3.5.0 → monkeybot-3.6.1}/src/monkeybot/core/tools/fs_isolation.py

@@ -27,8 +27,10 @@ profile instead: read is allowed everywhere except a set of ``deny`` roots
 (the user's home directory, primarily), read+write is granted on top for a
 small set of ``read_write`` roots (the workspace, artifacts, memory palace,
 OS temp dirs), and read-only for ``read_only`` roots (skills, the interpreter
-prefix, granted folders) even when those happen to sit inside a denied root —
-which is the common case for a desktop app whose workspace and bundled
+prefix, granted folders, ``bin`` directories already on ``PATH``, and an
+installed on-device Whisper model directory) even
+when those happen to sit inside a denied root — which is the common case
+for a desktop app whose workspace and bundled
 Python both live under the user's home directory. Validated empirically
 against real `python3`, `git`, `uv`, and `bash` invocations under
 `sandbox-exec` on macOS; the Linux mount-namespace path follows the same
@@ -46,7 +48,7 @@ import os
 import subprocess
 import sys
 import tempfile
-from collections.abc import Sequence
+from collections.abc import Mapping, Sequence
 from dataclasses import dataclass
 from pathlib import Path
 
@@ -421,6 +423,150 @@ def _resolved_strs(paths: Sequence[Path]) -> list[str]:
     return [str(Path(p).expanduser().resolve()) for p in paths]
 
 
+def _is_strict_child(path: Path, root: Path) -> bool:
+    try:
+        path.relative_to(root)
+    except ValueError:
+        return False
+    return path != root
+
+
+def _resolved_deny_roots(deny: Sequence[Path]) -> list[Path]:
+    roots: list[Path] = []
+    for root in deny:
+        try:
+            roots.append(Path(root).expanduser().resolve())
+        except (OSError, RuntimeError):
+            continue
+    return roots
+
+
+def readable_bin_dirs_under_deny(
+    deny: Sequence[Path],
+    *,
+    path_env: str | None = None,
+) -> tuple[Path, ...]:
+    """PATH ``bin`` directories that sit strictly inside a denied root.
+
+    Onefile bootloaders exec, then ``open()`` their own file to read the
+    embedded archive. ``process-exec`` is allowed, but file-read under the
+    denied home directory is not, so that open fails ("Could not load
+    PyInstaller's embedded PKG archive") unless the binary's directory is an
+    explicit read-only root. Only directories whose final component is
+    ``bin`` qualify, and a PATH entry of the deny root itself is ignored so
+    ``$HOME`` on PATH cannot reopen the whole tree.
+    """
+    if path_env is None:
+        path_env = os.environ.get("PATH", "")
+    deny_roots = _resolved_deny_roots(deny)
+    if not deny_roots:
+        return ()
+    found: list[Path] = []
+    seen: set[Path] = set()
+    for part in path_env.split(os.pathsep):
+        part = part.strip()
+        if not part:
+            continue
+        try:
+            path = Path(part).expanduser().resolve()
+        except (OSError, RuntimeError):
+            continue
+        if path.name != "bin" or not path.is_dir():
+            continue
+        if _SEATBELT_PATH_METACHARS.intersection(str(path)):
+            logger.debug("skipping PATH bin dir with seatbelt metacharacters: %s", path)
+            continue
+        if not any(_is_strict_child(path, root) for root in deny_roots):
+            continue
+        if path in seen:
+            continue
+        seen.add(path)
+        found.append(path)
+    return tuple(found)
+
+
+def _nonempty_file(path: Path) -> bool:
+    try:
+        return path.is_file() and path.stat().st_size > 0
+    except OSError as exc:
+        logger.debug("skipping whisper model file %s: %s", path, exc)
+        return False
+
+
+def _whisper_weights_present(model_dir: Path) -> bool:
+    try:
+        return any(_nonempty_file(path) for path in model_dir.glob("ggml-*.bin"))
+    except OSError as exc:
+        logger.debug("skipping whisper model dir %s: %s", model_dir, exc)
+        return False
+
+
+def local_whisper_model_dirs(
+    *,
+    home: Path | None = None,
+    env: Mapping[str, str] | None = None,
+    deny: Sequence[Path] = (),
+) -> tuple[Path, ...]:
+    """Directories holding an installed on-device Whisper ggml model.
+
+    ``run_command`` denies file-read under the home directory, and
+    ``whisper-cli`` has to open the weights. Only the model file's parent
+    is granted, and only when a ``ggml-*.bin`` weights file is actually
+    there — an uninstalled model adds nothing. A directory that is, or
+    contains, a ``deny`` root is never granted, so ``WHISPER_MODEL=~/ggml-x.bin``
+    cannot reopen the whole home directory.
+    """
+    values = os.environ if env is None else env
+    deny_roots = _resolved_deny_roots(deny)
+    found: list[Path] = []
+    seen: set[Path] = set()
+
+    def _add(path: Path) -> None:
+        try:
+            resolved = path.expanduser().resolve()
+        except (OSError, RuntimeError) as exc:
+            logger.debug("skipping whisper model path %s: %s", path, exc)
+            return
+        if not resolved.is_dir():
+            return
+        if _SEATBELT_PATH_METACHARS.intersection(str(resolved)):
+            logger.debug(
+                "skipping whisper model dir with seatbelt metacharacters: %s",
+                resolved,
+            )
+            return
+        if any(root.is_relative_to(resolved) for root in deny_roots):
+            logger.debug("skipping whisper model dir that would expose a deny root: %s", resolved)
+            return
+        if resolved in seen:
+            return
+        seen.add(resolved)
+        found.append(resolved)
+
+    explicit = (values.get("WHISPER_MODEL") or "").strip()
+    if explicit:
+        model = Path(explicit).expanduser()
+        if model.match("ggml-*.bin") and _nonempty_file(model):
+            _add(model.parent)
+
+    raw_home = (values.get("MONKEYBOT_HOME") or "").strip()
+    if raw_home:
+        base = Path(raw_home).expanduser()
+    elif home is not None:
+        base = home
+    else:
+        try:
+            base = Path.home() / ".monkeybot"
+        except RuntimeError as exc:
+            logger.debug("whisper model dir lookup skipped: %s", exc)
+            base = None
+    if base is not None:
+        model_dir = base / "models" / "whisper"
+        if _whisper_weights_present(model_dir):
+            _add(model_dir)
+    return tuple(found)
+
+
 def _seatbelt_jail_profile(roots: JailRoots) -> str:
     deny = _resolved_strs(roots.deny)
     read_write = _resolved_strs(roots.read_write)
@@ -439,6 +585,10 @@ def _seatbelt_jail_profile(roots: JailRoots) -> str:
         "(allow sysctl-read)",
         "(allow file-read-metadata)",
         "(allow ipc-posix-shm)",
+        # PyInstaller onefile bootloaders (bundled yt-dlp) call semctl while
+        # unpacking. process-exec alone is not enough; without this the
+        # binary dies with "Failed to initialize sync semaphore".
+        "(allow ipc-sysv-sem)",
     ]
     if deny:
         lines.append(f'(allow file-read* (require-all (subpath "/") {deny_excludes}))')

{monkeybot-3.5.0 → monkeybot-3.6.1}/src/monkeybot/gateway/sse/models.py

@@ -144,6 +144,12 @@ class ToolConfirmationPOST(BaseModel):
     """When true with approved, remember this tool+resource for the rest of the session."""
 
 
+class AskUserPOST(BaseModel):
+    """POST /sessions/{id}/ask-user/{tool_call_id} body."""
+
+    answer: str
+
+
 class ElicitationPOST(BaseModel):
     """POST /sessions/{id}/elicitations/{id} body."""
 

{monkeybot-3.5.0 → monkeybot-3.6.1}/src/monkeybot/gateway/sse/routes.py

@@ -48,6 +48,7 @@ from .models import (
     AdmissionAcceptedResponse,
     AgentUsageResponse,
     APIError,
+    AskUserPOST,
     AttachmentUploadResponse,
     CancelRequest,
     CreateSessionRequest,
@@ -1065,6 +1066,44 @@ def create_app(
             )
         return {"ok": True}
 
+    @api.post("/sessions/{session_id}/ask-user/{tool_call_id}", status_code=202)
+    async def post_ask_user(
+        session_id: str,
+        tool_call_id: str,
+        body: AskUserPOST,
+        reg_dep: SessionRegistry = Depends(get_registry),
+    ) -> dict[str, bool]:
+        rid = uuid.uuid4().hex
+        answer = body.answer.strip()
+        if not answer:
+            raise APIError(400, "EMPTY_ANSWER", "ask_user requires a non-empty answer", rid)
+        bus = reg_dep.get(session_id)
+        if bus is None:
+            raise APIError(404, "SESSION_NOT_FOUND", "Unknown session", rid)
+        state = bus.is_pending_or_terminal(tool_call_id)
+        if state == "unknown":
+            raise APIError(
+                404,
+                "PENDING_UNKNOWN",
+                "Pending response id is not registered for this session",
+                rid,
+            )
+        if state == "terminated":
+            raise APIError(
+                409,
+                "STALE_PENDING_RESPONSE",
+                "This pending response was already resolved, cancelled, or timed out",
+                rid,
+            )
+        if not bus.resolve_pending(tool_call_id, {"answer": answer}):
+            raise APIError(
+                409,
+                "STALE_PENDING_RESPONSE",
+                "This pending response was already resolved, cancelled, or timed out",
+                rid,
+            )
+        return {"ok": True}
+
     @api.post("/sessions/{session_id}/elicitations/{elicitation_id}", status_code=202)
     async def post_elicitation(
         session_id: str,