monkeybot 3.6.0__tar.gz → 3.6.1__tar.gz

{monkeybot-3.6.0 → monkeybot-3.6.1}/CHANGELOG.md

@@ -6,7 +6,14 @@ the project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
-### CLI
+## [core v3.6.1] - 2026-09-26
+
+### Fixed
+
+- `run_command`'s macOS jail can launch onefile binaries that live under the home directory. Bundled `yt-dlp` needs to read its own executable and create a SysV semaphore; both were denied, so `/watch-video` died before any download.
+- `run_command` can read an installed on-device Whisper model under the home directory, so `/watch-video` can transcribe with it.
+
+## [cli v0.8.0] - 2026-09-21
 
 #### Added
 

{monkeybot-3.6.0 → monkeybot-3.6.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: monkeybot
-Version: 3.6.0
+Version: 3.6.1
 Summary: monkeybot agent harness — FastAPI SSE gateway, owned loop, SQLite, and MCP.
 License: MIT
 License-File: LICENSE

{monkeybot-3.6.0 → monkeybot-3.6.1}/cli/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "monkeybot-cli"
-version = "0.7.0"
+version = "0.8.0"
 description = "CLI to create, configure, validate, and chat with monkeybot agents."
 requires-python = ">=3.11"
 dependencies = [

{monkeybot-3.6.0 → monkeybot-3.6.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "monkeybot"
-version = "3.6.0"
+version = "3.6.1"
 description = "monkeybot agent harness — FastAPI SSE gateway, owned loop, SQLite, and MCP."
 requires-python = ">=3.11"
 readme = "README.md"

{monkeybot-3.6.0 → monkeybot-3.6.1}/src/monkeybot/core/tools/core_tool_executor.py

@@ -97,7 +97,12 @@ from monkeybot.core.subprocess_groups import (
     stop_subagent_process,
 )
 from monkeybot.core.tools.ask_user import await_ask_user_answer, parse_ask_user_args
-from monkeybot.core.tools.fs_isolation import JailRoots, memory_hidden_paths
+from monkeybot.core.tools.fs_isolation import (
+    JailRoots,
+    local_whisper_model_dirs,
+    memory_hidden_paths,
+    readable_bin_dirs_under_deny,
+)
 from monkeybot.core.tools.grant_store import PATH_GRANT_TOOLS, GrantStoreCache
 from monkeybot.core.tools.inspector import parse_run_command
 from monkeybot.core.tools.sandbox_executor import SandboxConfig, SandboxExecutor
@@ -1924,8 +1929,11 @@ class CoreToolExecutor(ToolExecutorPort):
         a sibling of the workspace, not under it), OS temp dirs (read+write,
         many toolchains stage there), skills and the interpreter's own
         install prefix (read-only — the interpreter can live under $HOME for
-        a bundled desktop app), and any folder the user has granted read
-        access to, durably or for this turn (read-only).
+        a bundled desktop app), PATH ``bin`` directories that sit inside the
+        denied home (read-only — onefile tools such as bundled ``yt-dlp``
+        have to read their own executable), an installed on-device Whisper
+        model directory (read-only), and any folder the user has
+        granted read access to, durably or for this turn (read-only).
         """
         read_write: list[Path] = [self._workspace.repo_root]
         if self._artifacts_path is not None:
@@ -1958,6 +1966,8 @@ class CoreToolExecutor(ToolExecutorPort):
         deny: list[Path] = []
         with contextlib.suppress(RuntimeError):
             deny.append(Path.home())
+        read_only.extend(readable_bin_dirs_under_deny(deny))
+        read_only.extend(local_whisper_model_dirs(deny=deny))
 
         return JailRoots(
             read_write=tuple(dict.fromkeys(p.resolve() for p in read_write)),

{monkeybot-3.6.0 → monkeybot-3.6.1}/src/monkeybot/core/tools/fs_isolation.py

@@ -27,8 +27,10 @@ profile instead: read is allowed everywhere except a set of ``deny`` roots
 (the user's home directory, primarily), read+write is granted on top for a
 small set of ``read_write`` roots (the workspace, artifacts, memory palace,
 OS temp dirs), and read-only for ``read_only`` roots (skills, the interpreter
-prefix, granted folders) even when those happen to sit inside a denied root —
-which is the common case for a desktop app whose workspace and bundled
+prefix, granted folders, ``bin`` directories already on ``PATH``, and an
+installed on-device Whisper model directory) even
+when those happen to sit inside a denied root — which is the common case
+for a desktop app whose workspace and bundled
 Python both live under the user's home directory. Validated empirically
 against real `python3`, `git`, `uv`, and `bash` invocations under
 `sandbox-exec` on macOS; the Linux mount-namespace path follows the same
@@ -46,7 +48,7 @@ import os
 import subprocess
 import sys
 import tempfile
-from collections.abc import Sequence
+from collections.abc import Mapping, Sequence
 from dataclasses import dataclass
 from pathlib import Path
 
@@ -421,6 +423,150 @@ def _resolved_strs(paths: Sequence[Path]) -> list[str]:
     return [str(Path(p).expanduser().resolve()) for p in paths]
 
 
+def _is_strict_child(path: Path, root: Path) -> bool:
+    try:
+        path.relative_to(root)
+    except ValueError:
+        return False
+    return path != root
+
+
+def _resolved_deny_roots(deny: Sequence[Path]) -> list[Path]:
+    roots: list[Path] = []
+    for root in deny:
+        try:
+            roots.append(Path(root).expanduser().resolve())
+        except (OSError, RuntimeError):
+            continue
+    return roots
+
+
+def readable_bin_dirs_under_deny(
+    deny: Sequence[Path],
+    *,
+    path_env: str | None = None,
+) -> tuple[Path, ...]:
+    """PATH ``bin`` directories that sit strictly inside a denied root.
+
+    Onefile bootloaders exec, then ``open()`` their own file to read the
+    embedded archive. ``process-exec`` is allowed, but file-read under the
+    denied home directory is not, so that open fails ("Could not load
+    PyInstaller's embedded PKG archive") unless the binary's directory is an
+    explicit read-only root. Only directories whose final component is
+    ``bin`` qualify, and a PATH entry of the deny root itself is ignored so
+    ``$HOME`` on PATH cannot reopen the whole tree.
+    """
+    if path_env is None:
+        path_env = os.environ.get("PATH", "")
+    deny_roots = _resolved_deny_roots(deny)
+    if not deny_roots:
+        return ()
+    found: list[Path] = []
+    seen: set[Path] = set()
+    for part in path_env.split(os.pathsep):
+        part = part.strip()
+        if not part:
+            continue
+        try:
+            path = Path(part).expanduser().resolve()
+        except (OSError, RuntimeError):
+            continue
+        if path.name != "bin" or not path.is_dir():
+            continue
+        if _SEATBELT_PATH_METACHARS.intersection(str(path)):
+            logger.debug("skipping PATH bin dir with seatbelt metacharacters: %s", path)
+            continue
+        if not any(_is_strict_child(path, root) for root in deny_roots):
+            continue
+        if path in seen:
+            continue
+        seen.add(path)
+        found.append(path)
+    return tuple(found)
+
+
+def _nonempty_file(path: Path) -> bool:
+    try:
+        return path.is_file() and path.stat().st_size > 0
+    except OSError as exc:
+        logger.debug("skipping whisper model file %s: %s", path, exc)
+        return False
+
+
+def _whisper_weights_present(model_dir: Path) -> bool:
+    try:
+        return any(_nonempty_file(path) for path in model_dir.glob("ggml-*.bin"))
+    except OSError as exc:
+        logger.debug("skipping whisper model dir %s: %s", model_dir, exc)
+        return False
+
+
+def local_whisper_model_dirs(
+    *,
+    home: Path | None = None,
+    env: Mapping[str, str] | None = None,
+    deny: Sequence[Path] = (),
+) -> tuple[Path, ...]:
+    """Directories holding an installed on-device Whisper ggml model.
+
+    ``run_command`` denies file-read under the home directory, and
+    ``whisper-cli`` has to open the weights. Only the model file's parent
+    is granted, and only when a ``ggml-*.bin`` weights file is actually
+    there — an uninstalled model adds nothing. A directory that is, or
+    contains, a ``deny`` root is never granted, so ``WHISPER_MODEL=~/ggml-x.bin``
+    cannot reopen the whole home directory.
+    """
+    values = os.environ if env is None else env
+    deny_roots = _resolved_deny_roots(deny)
+    found: list[Path] = []
+    seen: set[Path] = set()
+
+    def _add(path: Path) -> None:
+        try:
+            resolved = path.expanduser().resolve()
+        except (OSError, RuntimeError) as exc:
+            logger.debug("skipping whisper model path %s: %s", path, exc)
+            return
+        if not resolved.is_dir():
+            return
+        if _SEATBELT_PATH_METACHARS.intersection(str(resolved)):
+            logger.debug(
+                "skipping whisper model dir with seatbelt metacharacters: %s",
+                resolved,
+            )
+            return
+        if any(root.is_relative_to(resolved) for root in deny_roots):
+            logger.debug("skipping whisper model dir that would expose a deny root: %s", resolved)
+            return
+        if resolved in seen:
+            return
+        seen.add(resolved)
+        found.append(resolved)
+
+    explicit = (values.get("WHISPER_MODEL") or "").strip()
+    if explicit:
+        model = Path(explicit).expanduser()
+        if model.match("ggml-*.bin") and _nonempty_file(model):
+            _add(model.parent)
+
+    raw_home = (values.get("MONKEYBOT_HOME") or "").strip()
+    if raw_home:
+        base = Path(raw_home).expanduser()
+    elif home is not None:
+        base = home
+    else:
+        try:
+            base = Path.home() / ".monkeybot"
+        except RuntimeError as exc:
+            logger.debug("whisper model dir lookup skipped: %s", exc)
+            base = None
+    if base is not None:
+        model_dir = base / "models" / "whisper"
+        if _whisper_weights_present(model_dir):
+            _add(model_dir)
+    return tuple(found)
+
+
 def _seatbelt_jail_profile(roots: JailRoots) -> str:
     deny = _resolved_strs(roots.deny)
     read_write = _resolved_strs(roots.read_write)
@@ -439,6 +585,10 @@ def _seatbelt_jail_profile(roots: JailRoots) -> str:
         "(allow sysctl-read)",
         "(allow file-read-metadata)",
         "(allow ipc-posix-shm)",
+        # PyInstaller onefile bootloaders (bundled yt-dlp) call semctl while
+        # unpacking. process-exec alone is not enough; without this the
+        # binary dies with "Failed to initialize sync semaphore".
+        "(allow ipc-sysv-sem)",
     ]
     if deny:
         lines.append(f'(allow file-read* (require-all (subpath "/") {deny_excludes}))')

{monkeybot-3.6.0 → monkeybot-3.6.1}/tests/core/test_fs_isolation.py

@@ -2,8 +2,11 @@
 
 from __future__ import annotations
 
+import os
+import shutil
 import subprocess
 import sys
+import tempfile
 from pathlib import Path
 
 import pytest
@@ -18,7 +21,9 @@ from monkeybot.core.tools.fs_isolation import (
     isolation_failed,
     isolation_support,
     jailed_argv,
+    local_whisper_model_dirs,
     memory_hidden_paths,
+    readable_bin_dirs_under_deny,
     reset_isolation_support_cache,
 )
 
@@ -254,6 +259,100 @@ class TestJailRoots:
         assert not JailRoots(always_deny=(Path("/ws/palace"),)).is_empty()
 
 
+class TestReadableBinDirs:
+    def test_only_bin_dirs_strictly_inside_a_deny_root(self, tmp_path: Path):
+        home = tmp_path / "home"
+        tools = home / "app" / "vendor" / "tools" / "bin"
+        local_bin = home / ".local" / "bin"
+        documents = home / "Documents"
+        outside = tmp_path / "opt" / "homebrew" / "bin"
+        for path in (tools, local_bin, documents, outside):
+            path.mkdir(parents=True)
+
+        found = readable_bin_dirs_under_deny(
+            (home,),
+            path_env=os.pathsep.join(
+                [str(tools), str(documents), str(home), str(outside), str(local_bin), ""]
+            ),
+        )
+
+        assert tools.resolve() in found
+        assert local_bin.resolve() in found
+        assert documents.resolve() not in found
+        assert home.resolve() not in found
+        assert outside.resolve() not in found
+
+    def test_skips_paths_that_would_break_the_seatbelt_profile(self, tmp_path: Path):
+        home = tmp_path / "home"
+        bad = home / 'bin"(allow default)' / "bin"
+        bad.mkdir(parents=True)
+
+        found = readable_bin_dirs_under_deny((home,), path_env=str(bad))
+        assert found == ()
+
+
+class TestLocalWhisperModelDirs:
+    def test_grants_the_model_directory_only_when_weights_exist(self, tmp_path: Path):
+        home = tmp_path / "monkeybot"
+        model_dir = home / "models" / "whisper"
+        model_dir.mkdir(parents=True)
+        assert local_whisper_model_dirs(home=home, env={}) == ()
+
+        empty = model_dir / "ggml-empty.bin"
+        empty.write_bytes(b"")
+        assert local_whisper_model_dirs(home=home, env={}) == ()
+
+        weights = model_dir / "ggml-custom.bin"
+        weights.write_bytes(b"weights")
+        assert local_whisper_model_dirs(home=home, env={}) == (model_dir.resolve(),)
+
+    def test_explicit_model_path_grants_its_parent(self, tmp_path: Path):
+        model = tmp_path / "custom" / "ggml-custom.bin"
+        model.parent.mkdir()
+        model.write_bytes(b"weights")
+        empty_home = tmp_path / "empty-home"
+        empty_home.mkdir()
+
+        found = local_whisper_model_dirs(
+            home=empty_home,
+            env={"WHISPER_MODEL": str(model), "MONKEYBOT_HOME": str(empty_home)},
+        )
+        assert found == (model.parent.resolve(),)
+
+    def test_explicit_model_must_be_named_like_ggml_weights(self, tmp_path: Path):
+        model = tmp_path / "custom" / "notes.bin"
+        model.parent.mkdir()
+        model.write_bytes(b"weights")
+        empty_home = tmp_path / "empty-home"
+        empty_home.mkdir()
+
+        found = local_whisper_model_dirs(
+            home=empty_home,
+            env={"WHISPER_MODEL": str(model), "MONKEYBOT_HOME": str(empty_home)},
+        )
+        assert found == ()
+
+    def test_explicit_model_cannot_expose_a_deny_root(self, tmp_path: Path):
+        home = tmp_path / "home"
+        home.mkdir()
+        model = home / "ggml-base.bin"
+        model.write_bytes(b"weights")
+        empty_home = tmp_path / "empty-home"
+        empty_home.mkdir()
+        env = {"WHISPER_MODEL": str(model), "MONKEYBOT_HOME": str(empty_home)}
+
+        assert local_whisper_model_dirs(home=empty_home, env=env, deny=(home,)) == ()
+        assert local_whisper_model_dirs(home=empty_home, env=env, deny=(home / "sub",)) == ()
+
+        nested = home / "models" / "ggml-base.bin"
+        nested.parent.mkdir()
+        nested.write_bytes(b"weights")
+        env["WHISPER_MODEL"] = str(nested)
+        assert local_whisper_model_dirs(home=empty_home, env=env, deny=(home,)) == (
+            nested.parent.resolve(),
+        )
+
+
 class TestJailedArgv:
     def test_empty_roots_is_a_passthrough(self):
         support = IsolationSupport("namespace", "test")
@@ -283,6 +382,7 @@ class TestJailedArgv:
         assert '(require-not (subpath "/Users/x"))' in profile
         assert '(allow file-read* file-write* (subpath "/Users/x/agent/workspace"))' in profile
         assert '(allow file-read* (subpath "/Users/x/agent/skills"))' in profile
+        assert "(allow ipc-sysv-sem)" in profile
         assert args[-2:] == ["/bin/bash", "-c"] or args[-3:] == ["/bin/bash", "-c", "true"]
 
     def test_sandbox_exec_profile_allows_gitconfig_by_name(self, monkeypatch):
@@ -584,6 +684,35 @@ class TestMacJailBootstrap:
         assert other.returncode == 0
         assert "workspace-content" in other.stdout
 
+    def test_pyinstaller_binary_under_home_can_start(self, tmp_path: Path):
+        """Onefile binaries under $HOME must be readable and may call semctl.
+
+        Bundled yt-dlp fails closed without both: file-read of its own
+        executable, and ipc-sysv-sem. Skip unless the yt-dlp on PATH lives
+        under $HOME; a system install elsewhere would not exercise either.
+        """
+        home = Path.home()
+        yt_dlp = shutil.which("yt-dlp")
+        if yt_dlp is None or not Path(yt_dlp).resolve().is_relative_to(home.resolve()):
+            pytest.skip("needs a yt-dlp binary under $HOME on PATH")
+        workspace = tmp_path / "workspace"
+        workspace.mkdir()
+        shared = [Path(tempfile.gettempdir())]
+        for extra in ("/tmp", "/private/tmp"):
+            if os.path.isdir(extra):
+                shared.append(Path(extra))
+        roots = JailRoots(
+            deny=(home,),
+            read_write=(workspace,),
+            read_only=readable_bin_dirs_under_deny((home,)),
+            shared_write=tuple(shared),
+        )
+
+        proc = self._run(roots, [yt_dlp, "--version"], cwd=workspace)
+
+        assert proc.returncode == 0, proc.stderr
+        assert proc.stdout.strip()
+
 
 @pytest.mark.skipif(
     not sys.platform.startswith("linux"),