monkeybot 3.9.0__tar.gz → 3.10.0__tar.gz

{monkeybot-3.9.0 → monkeybot-3.10.0}/.github/workflows/ci.yml

@@ -29,7 +29,7 @@ jobs:
         run: uv run mypy src/monkeybot
 
       - name: Pytest
-        run: uv run pytest tests/ -q
+        run: uv run pytest tests/ -q -n auto
 
       - name: CLI pytest
         working-directory: cli
@@ -49,3 +49,4 @@ jobs:
           uv run python evals/test_assertions.py
           uv run python evals/test_report.py
           uv run python evals/test_runner_sse.py
+          uv run python evals/test_coding_hard_oracle.py

{monkeybot-3.9.0 → monkeybot-3.10.0}/.gitignore

@@ -68,4 +68,8 @@ code/
 .evals-venv/
 
 # monkeythink
-.monkeythink/
+.monkeythink/
+# Eval fixtures ship their own build/ decoy
+!/evals/fixtures/coding/calc_repo/build/
+!/evals/fixtures/coding/calc_repo_green/build/
+!/evals/fixtures/coding/shop_repo/build/

{monkeybot-3.9.0 → monkeybot-3.10.0}/CHANGELOG.md

@@ -10,9 +10,47 @@ the project adheres to [Semantic Versioning](https://semver.org/).
 
 ### Added
 
+- `monkeybot new --template coding` scaffolds an agent with a coding `AGENT.md`, a toolchain command allowlist (including yarn, with `rm` denied inside `bash -c`), ask-before-push permissions that also match chained commands and `bash -c`, and `coding.verification_gate` turned on.
+- `monkeybot mcp-login` signs in to one remote MCP server in the browser and writes the token file core reuses.
+- New scaffolds list `./tests/` and `./src/` in `command_allowlist.yaml`. `refresh` does not re-add them to an allowlist you already configured.
+
+## [core v3.10.0] - 2026-10-22
+
+### Added
+
+- Coding mode for agents that work in a repository. It adds an editing & verification protocol to the prompt, puts `AGENTS.md` / `CLAUDE.md` and a short repo overview in the cached prompt prefix, reports git branch and dirty files each turn, refuses edits to files the model has not read (`read_before_write`) or that changed since (`stale_read`), and — with `coding.verification_gate` — refuses a final answer that follows edits no test or lint run has passed since. See `docs/features.md` §22.
+- Hooks: `PRE_FINAL_ANSWER` (a hook may refuse a final answer once the tools are done; `BEFORE_PROVIDER_REQUEST` may hold the text until then) and `HISTORY_COMPACTED` (awaited after history is summarized). A tool failing on the same file repeatedly trips doom-loop recovery even when its other arguments, or the path's spelling, change.
+- New `list_dir` tool. `grep` gains `context`, `files_only` and `respect_gitignore`; `glob` takes `files_only` and no longer walks `node_modules`, `.git`, `build` and similar. `replace_in_file` and `apply_patch` return the edited `line` and a numbered `snippet`. Skills appear in the prompt as `name — description`.
+- Live eval suites `coding` and `coding_hard` (`evals/suites/`) over fixture repos, with workspace-checked assertions (`workspace_command_passes`, `workspace_file_contains`, `workspace_unchanged`, `final_text_regex`, `verified_before_final`), seeded-bug overlays, and `python -m evals.trials` to run a suite repeatedly and compare configurations. The eval runner answers `ask_user` prompts so a run cannot hang waiting for a human.
+- Remote MCP servers can sign in with browser OAuth. Tokens are stored per server and reused on later connects; a failed refresh is reported as an auth error.
+
+### Changed
+
+- Coding mode is always on for every agent. `coding.enabled` is retired: a leftover `coding: {enabled: ...}` is ignored with a warning. Every agent now gets the editing & verification protocol, the read-before-write ledger (`read_before_write` / `stale_read` refusals), project instructions and repo overview in the cached prompt prefix, and git state in runtime notes. `coding.verification_gate.enabled` stays opt-in.
+- `glob` returns files only by default; pass `files_only: false` to also list directories. `bash -c` scripts are screened command by command against `deny_patterns`.
+
+### Fixed
+
+- `run_command` output over the spill threshold no longer hides `exit_code`, `stderr` and the end of the output behind a truncated JSON prefix. The result stays valid JSON with head/tail excerpts and the full streams at `output_path`.
+- `run_command` accepts `./tests/` and `./src/` path arguments (relative or workspace-absolute) under the built-in defaults, so `pytest ./tests` is no longer rejected. A configured allowlist is not widened.
+- `deny_patterns` that anchor on the start of a command (`^rm\s+-rf`, `^curl`, `^sudo`) now also apply to commands inside `bash -c "…"`. A `bash -c` script that cannot be screened is rejected instead of run.
+- The progress tracker's `write_without_read` / `rewrite_churn` signals never fired for `replace_in_file` (it tracked a tool name that does not exist).
+- `apply_patch` rejects a hunk whose old lines match several places instead of silently editing the first, rejects hunk lines with no valid prefix instead of dropping them, and honors `*** End of File`.
+- Subagent personas' `model` and `vertex_location` are used by `task` instead of the parent's model.
+- A provider call that fails with an empty message (for example an `httpx.ReadTimeout`) now reports `Provider request failed (<ExceptionType>)` instead of a blank error.
+- Over-budget tool text keeps its tail (70% head / 30% tail) instead of only its head.
+
+## [cli v0.10.0] - 2026-10-18
+
+### Added
+
 - `monkeybot doctor` reports `model.reasoning_effort`, including when a non-Claude Bedrock model will not receive it.
 - `fireworks` is a scaffold provider choice and validates with `FIREWORKS_API_KEY`.
 
+### Changed
+
+- Requires `monkeybot[cli]>=3.9.0,<4`. Doctor imports the reasoning-effort helpers added in core 3.9.0.
+
 ## [core v3.9.0] - 2026-10-18
 
 ### Added

{monkeybot-3.9.0 → monkeybot-3.10.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: monkeybot
-Version: 3.9.0
+Version: 3.10.0
 Summary: monkeybot agent harness — FastAPI SSE gateway, owned loop, SQLite, and MCP.
 License: MIT
 License-File: LICENSE

{monkeybot-3.9.0 → monkeybot-3.10.0}/cli/pyproject.toml

@@ -4,13 +4,13 @@ build-backend = "hatchling.build"
 
 [project]
 name = "monkeybot-cli"
-version = "0.9.0"
+version = "0.10.0"
 description = "CLI to create, configure, validate, and chat with monkeybot agents."
 requires-python = ">=3.11"
 dependencies = [
     # `cli` pulls realtime + typer so `monkeybot talk` works out of the box (text mode).
     # Audio mic/PTT needs the agent (or this env) to also install monkeybot[cli-realtime].
-    "monkeybot[cli]>=3.8.0,<4",
+    "monkeybot[cli]>=3.9.0,<4",
     "monkeybot-browser-mcp>=0.5.0,<1",
     "httpx>=0.27.0",
     "pyyaml>=6.0.2",

monkeybot-3.10.0/cli/src/monkeybot_cli/commands/mcp_login.py

@@ -0,0 +1,81 @@
+"""monkeybot mcp-login — browser sign-in for one remote MCP server."""
+
+from __future__ import annotations
+
+import argparse
+import asyncio
+import json
+import logging
+import os
+import sys
+from pathlib import Path
+
+from mcp.client.auth.exceptions import OAuthFlowError
+from monkeybot.core.mcp.mcp_client import MCPAuthError
+from monkeybot.core.mcp.oauth_flow import login_mcp_server
+
+logger = logging.getLogger(__name__)
+
+CLIENT_SECRET_ENV = "MONKEYBOT_MCP_CLIENT_SECRET"
+
+
+def run_mcp_login(args: argparse.Namespace) -> int:
+    """Sign in, print JSON progress on stdout, and return 0 when the attempt finishes."""
+    client_secret = args.client_secret or os.environ.get(CLIENT_SECRET_ENV, "")
+    try:
+        result = asyncio.run(
+            login_mcp_server(
+                args.url,
+                Path(args.storage).expanduser(),
+                open_browser=not args.no_browser,
+                client_id=args.client_id,
+                client_secret=client_secret,
+                redirect_port=args.redirect_port,
+            )
+        )
+    except (MCPAuthError, OAuthFlowError) as exc:
+        print(str(exc), file=sys.stderr)
+        return 1
+    except Exception:
+        logger.exception("mcp oauth sign-in failed")
+        print("Sign-in failed.", file=sys.stderr)
+        return 1
+    print(json.dumps(result), flush=True)
+    return 0
+
+
+def register(sub: argparse._SubParsersAction[argparse.ArgumentParser]) -> None:
+    """Register the ``mcp-login`` subcommand."""
+    command = sub.add_parser(
+        "mcp-login",
+        help="Sign in to a remote MCP server in the browser",
+    )
+    command.add_argument("--url", required=True, help="Streamable HTTP URL of the MCP server")
+    command.add_argument(
+        "--storage", required=True, help="Directory for this machine's OAuth tokens"
+    )
+    command.add_argument(
+        "--no-browser",
+        action="store_true",
+        help="Print the authorization URL instead of opening a browser",
+    )
+    command.add_argument(
+        "--client-id",
+        default="",
+        help="OAuth client id, for a server that will not register one automatically",
+    )
+    command.add_argument(
+        "--client-secret",
+        default="",
+        help=(
+            f"OAuth client secret, when that client requires one. Prefer {CLIENT_SECRET_ENV}: "
+            "command-line arguments are visible to other processes."
+        ),
+    )
+    command.add_argument(
+        "--redirect-port",
+        type=int,
+        default=None,
+        help="Loopback port for the sign-in redirect, for a client registered with an exact URI",
+    )
+    command.set_defaults(func=run_mcp_login)

{monkeybot-3.9.0 → monkeybot-3.10.0}/cli/src/monkeybot_cli/commands/new.py

@@ -13,7 +13,7 @@ from monkeybot_cli.extras_catalog import (
     additional_provider_extra_choices,
     normalize_extra_token,
 )
-from monkeybot_cli.scaffold import run_new
+from monkeybot_cli.scaffold import DEFAULT_TEMPLATE, TEMPLATES, run_new
 
 _DEFAULT_PROVIDER = "gemini"
 _DEFAULT_MODEL = "gemini-3-flash"
@@ -26,7 +26,19 @@ def _prompt_line(prompt: str) -> str:
         return ""
 
 
-def _prompt_single(choices: tuple[ExtraChoice, ...], *, title: str, default_key: str) -> str:
+TEMPLATE_CHOICES: tuple[ExtraChoice, ...] = (
+    ExtraChoice("default", "General-purpose agent"),
+    ExtraChoice("coding", "Coding agent for a repository (verification gate, dev toolchain)"),
+)
+
+
+def _prompt_single(
+    choices: tuple[ExtraChoice, ...],
+    *,
+    title: str,
+    default_key: str,
+    noun: str = "provider",
+) -> str:
     """Numbered single-select; Enter keeps default_key."""
     print(title)
     default_idx = 1
@@ -35,7 +47,7 @@ def _prompt_single(choices: tuple[ExtraChoice, ...], *, title: str, default_key:
         if choice.key == default_key:
             default_idx = i
         print(f"  {i}) {choice.key} — {choice.label}{marker}")
-    raw = _prompt_line(f"Choose provider [{default_idx}]: ").strip()
+    raw = _prompt_line(f"Choose {noun} [{default_idx}]: ").strip()
     if not raw:
         return default_key
     if raw.isdigit():
@@ -48,7 +60,7 @@ def _prompt_single(choices: tuple[ExtraChoice, ...], *, title: str, default_key:
     for choice in choices:
         if raw.lower() == choice.key.lower():
             return choice.key
-    print(f"  unknown provider {raw!r}; using {default_key}", file=sys.stderr)
+    print(f"  unknown {noun} {raw!r}; using {default_key}", file=sys.stderr)
     return default_key
 
 
@@ -128,6 +140,13 @@ def run_new_command(args: argparse.Namespace) -> int:
 
     provider = args.provider
     model = args.model
+    template = getattr(args, "template", None)
+    if template is not None and template not in TEMPLATES:
+        print(
+            f"error: unknown --template {template!r}; choose from {', '.join(TEMPLATES)}",
+            file=sys.stderr,
+        )
+        return 2
     extras, unknown = _resolve_extras_from_args(getattr(args, "with_extras", None))
     if unknown:
         print(
@@ -137,6 +156,13 @@ def run_new_command(args: argparse.Namespace) -> int:
         return 2
 
     if not args.yes:
+        if template is None:
+            template = _prompt_single(
+                TEMPLATE_CHOICES,
+                title="Template:",
+                default_key=DEFAULT_TEMPLATE,
+                noun="template",
+            )
         if provider is None:
             provider = _prompt_single(
                 PROVIDER_CHOICES,
@@ -167,6 +193,7 @@ def run_new_command(args: argparse.Namespace) -> int:
         provider=provider,
         model=model,
         extras=extras or None,
+        template=template or DEFAULT_TEMPLATE,
     )
     print(f"monkeybot scaffold under {dest}:")
     print("\n".join(report))
@@ -177,6 +204,12 @@ def run_new_command(args: argparse.Namespace) -> int:
     print("  cp .env.example .env   # then add provider keys")
     print("  monkeybot doctor")
     print("  monkeybot chat")
+    if template == "coding":
+        print()
+        print("Coding template: clone the repository into ./workspace.")
+        print("Path prefixes in command_allowlist.yaml are relative to paths.workspace_root,")
+        print("so ../memory is the agent memory only while that stays ./workspace.")
+        print("If you set paths.workspace_root to another directory, update those prefixes.")
     return 0
 
 
@@ -200,6 +233,13 @@ def register(subparsers: argparse._SubParsersAction[argparse.ArgumentParser]) ->
             "observability, openai, bedrock, claude"
         ),
     )
+    p.add_argument(
+        "--template",
+        choices=TEMPLATES,
+        default=None,
+        help="Scaffold flavour: default (general agent) or coding (repo workflow). "
+        "Prompted interactively when omitted.",
+    )
     p.add_argument("--force", action="store_true", help="Overwrite existing scaffold files")
     p.add_argument("--yes", "-y", action="store_true", help="Skip interactive prompts")
     p.set_defaults(func=run_new_command)

{monkeybot-3.9.0 → monkeybot-3.10.0}/cli/src/monkeybot_cli/main.py

@@ -5,7 +5,18 @@ from __future__ import annotations
 import argparse
 import sys
 
-from monkeybot_cli.commands import chat, doctor, loop, new, refresh, run_cmd, talk, trace, validate
+from monkeybot_cli.commands import (
+    chat,
+    doctor,
+    loop,
+    mcp_login,
+    new,
+    refresh,
+    run_cmd,
+    talk,
+    trace,
+    validate,
+)
 from monkeybot_cli.runtime_python import RuntimeUpgradeError, report_runtime_upgrade_error
 
 
@@ -25,6 +36,7 @@ def build_parser() -> argparse.ArgumentParser:
     talk.register(sub)
     loop.register(sub)
     trace.register(sub)
+    mcp_login.register(sub)
     return parser
 
 

{monkeybot-3.9.0 → monkeybot-3.10.0}/cli/src/monkeybot_cli/scaffold.py

@@ -17,6 +17,13 @@ _DEFAULTS_PKG: Final = "monkeybot_cli.scaffold_defaults"
 # Matches packaged monkeybot.example.yaml default when ``--provider`` is omitted.
 _DEFAULT_PROVIDER: Final = "gemini"
 
+TEMPLATES: Final[tuple[str, ...]] = ("default", "coding")
+DEFAULT_TEMPLATE: Final = "default"
+_TEMPLATES_DIR: Final = "templates"
+_OVERRIDES_FILE: Final = "monkeybot.overrides.yaml"
+# Files a template replaces in the base bundle (same output names).
+_TEMPLATE_FILES: Final[tuple[str, ...]] = ("AGENT.md", "command_allowlist.yaml", "permissions.yaml")
+
 # (filename in packaged defaults, output name under <dest>/monkeybot_config/)
 _CONFIG_BUNDLE: Final[tuple[tuple[str, str], ...]] = (
     ("monkeybot.example.yaml", "monkeybot.example.yaml"),
@@ -39,6 +46,49 @@ _MISSING_YAML_BANNER: Final = (
 )
 
 
+def _validate_template(template: str) -> str:
+    if template not in TEMPLATES:
+        raise ValueError(f"unknown template {template!r}; choose from {', '.join(TEMPLATES)}")
+    return template
+
+
+def _template_resource(template: str, name: str) -> Traversable:
+    return resources.files(_DEFAULTS_PKG) / _TEMPLATES_DIR / template / name
+
+
+def _config_bundle(template: str = DEFAULT_TEMPLATE) -> tuple[tuple[Traversable, str], ...]:
+    """``(source, output name)`` pairs for ``monkeybot_config/``, with template overlays applied."""
+    _validate_template(template)
+    out: list[tuple[Traversable, str]] = []
+    for src_name, dest_name in _CONFIG_BUNDLE:
+        if template != DEFAULT_TEMPLATE and dest_name in _TEMPLATE_FILES:
+            out.append((_template_resource(template, dest_name), dest_name))
+        else:
+            out.append((resources.files(_DEFAULTS_PKG) / src_name, dest_name))
+    return tuple(out)
+
+
+def _deep_merge(base: dict[str, Any], overlay: dict[str, Any]) -> dict[str, Any]:
+    merged = dict(base)
+    for key, value in overlay.items():
+        current = merged.get(key)
+        if isinstance(current, dict) and isinstance(value, dict):
+            merged[key] = _deep_merge(current, value)
+        else:
+            merged[key] = value
+    return merged
+
+
+def _template_overrides(template: str) -> dict[str, Any]:
+    if template == DEFAULT_TEMPLATE:
+        return {}
+    resource = _template_resource(template, _OVERRIDES_FILE)
+    if not resource.is_file():
+        return {}
+    loaded = yaml.safe_load(resource.read_text(encoding="utf-8"))
+    return loaded if isinstance(loaded, dict) else {}
+
+
 def _install_file(dest: Path, src: Traversable, *, force: bool) -> str:
     # ponytail: read_bytes() avoids resources.as_file() temp-file lifetime issue in zip distributions
     if dest.exists() and not force:
@@ -48,16 +98,14 @@ def _install_file(dest: Path, src: Traversable, *, force: bool) -> str:
     return "overwritten" if existed else "created"
 
 
-def install_config_bundle(cfg_dir: Path, *, force: bool) -> list[str]:
-    """Copy packaged defaults into ``cfg_dir``; return report lines."""
+def install_config_bundle(
+    cfg_dir: Path, *, force: bool, template: str = DEFAULT_TEMPLATE
+) -> list[str]:
+    """Copy packaged defaults (with ``template`` overlays) into ``cfg_dir``; return report lines."""
     cfg_dir.mkdir(parents=True, exist_ok=True)
     lines: list[str] = []
-    for src_name, dest_name in _CONFIG_BUNDLE:
-        status = _install_file(
-            cfg_dir / dest_name,
-            resources.files(_DEFAULTS_PKG) / src_name,
-            force=force,
-        )
+    for source, dest_name in _config_bundle(template):
+        status = _install_file(cfg_dir / dest_name, source, force=force)
         lines.append(f"  monkeybot_config/{dest_name}: {status}")
     return lines
 
@@ -68,8 +116,14 @@ def write_active_config(
     provider: str | None = None,
     model: str | None = None,
     force: bool = False,
+    template: str = DEFAULT_TEMPLATE,
 ) -> str:
-    """Create or update ``monkeybot.yaml`` from the packaged example."""
+    """Create or update ``monkeybot.yaml`` from the packaged example.
+
+    A non-default ``template`` deep-merges its ``monkeybot.overrides.yaml`` over the example
+    when the file is (re)created; an existing config is never re-templated.
+    """
+    _validate_template(template)
     active = cfg_dir / "monkeybot.yaml"
     if active.exists() and not force:
         if provider or model:
@@ -90,9 +144,11 @@ def write_active_config(
         encoding="utf-8"
     )
     active.write_text(example_text, encoding="utf-8")
-    if provider or model:
+    overrides = _template_overrides(template)
+    if provider or model or overrides:
         doc = yaml.safe_load(active.read_text(encoding="utf-8")) or {}
         if isinstance(doc, dict):
+            doc = _deep_merge(doc, overrides)
             model_sec = doc.setdefault("model", {})
             if isinstance(model_sec, dict):
                 if provider:
@@ -102,7 +158,7 @@ def write_active_config(
             active.write_text(yaml.safe_dump(doc, sort_keys=False), encoding="utf-8")
     if existed:
         return "overwritten"
-    if provider or model:
+    if provider or model or overrides:
         return "created"
     return "created (from monkeybot.example.yaml)"
 
@@ -301,6 +357,11 @@ def _list_extras(existing: list[str], template: list[str]) -> list[str]:
     return [item for item in existing if item not in present]
 
 
+# Convenience prefixes written on first scaffold only; refresh must not re-add them
+# to a file whose operator removed them.
+_CREATE_ONLY_PREFIXES = frozenset({"./tests/", "./src/"})
+
+
 def refresh_command_allowlist(cfg_dir: Path) -> str:
     """Rewrite from the packaged template, then re-append agent-only extras.
 
@@ -325,7 +386,11 @@ def refresh_command_allowlist(cfg_dir: Path) -> str:
             _as_str_list(existing.get(key)),
             _as_str_list(tmpl_map.get(key)),
         )
-        merged[key] = [*_as_str_list(tmpl_map.get(key)), *extras]
+        base = _as_str_list(tmpl_map.get(key))
+        if key == "allowed_path_prefixes":
+            have = set(_as_str_list(existing.get(key)))
+            base = [item for item in base if item not in _CREATE_ONLY_PREFIXES or item in have]
+        merged[key] = [*base, *extras]
     text = yaml.safe_dump(
         merged,
         sort_keys=False,
@@ -417,9 +482,13 @@ def run_new(
     provider: str | None = None,
     model: str | None = None,
     extras: list[str] | None = None,
+    template: str = DEFAULT_TEMPLATE,
 ) -> list[str]:
     """Full scaffold: config bundle, empty skills root, writable state, and image files.
 
+    ``template`` selects the persona/policy overlay: ``default`` (general agent) or ``coding``
+    (repo workflow: coding mode, verification gate, toolchain allowlist, ask-before-push rules).
+
     Optional capability skills (``browser``, ``image-generator``, ``loop``) are packaged
     under ``scaffold_defaults`` but not installed into new agents for now —
     the Mac Main Agent loads them from ``~/.monkeybot/.internal/skills``
@@ -427,12 +496,13 @@ def run_new(
     them again. The ``goal`` skill is installed because native goal tools are
     intentionally exposed only for explicit ``/goal`` invocations.
     """
+    _validate_template(template)
     cfg_dir = dest / "monkeybot_config"
-    report = install_config_bundle(cfg_dir, force=force)
-    report.append(
-        f"  monkeybot_config/monkeybot.yaml: "
-        f"{write_active_config(cfg_dir, provider=provider, model=model, force=force)}"
+    report = install_config_bundle(cfg_dir, force=force, template=template)
+    active_status = write_active_config(
+        cfg_dir, provider=provider, model=model, force=force, template=template
     )
+    report.append(f"  monkeybot_config/monkeybot.yaml: {active_status}")
     report.extend(ensure_memory(dest, force=force))
     report.extend(ensure_workspace(dest, force=force))
     report.append(f"  skills/goal/SKILL.md: {install_goal_skill(dest, force=force)}")

{monkeybot-3.9.0 → monkeybot-3.10.0}/cli/src/monkeybot_cli/scaffold_defaults/command_allowlist.yaml

@@ -15,6 +15,8 @@ allowed_commands:
 
 # Path prefixes permitted in run_command argv (./ and / arguments).
 allowed_path_prefixes:
+  - ./tests/  # e.g. pytest ./tests; add more workspace subtrees here as needed
+  - ./src/
   - ../memory/
   - ../memory
   - ../memory/mempalace/

{monkeybot-3.9.0 → monkeybot-3.10.0}/cli/src/monkeybot_cli/scaffold_defaults/monkeybot.example.yaml

@@ -254,6 +254,21 @@ scheduler:
 #   escalation:
 #     max_severity: nudge
 
+# Coding mode is always on: the agent gets an editing & verification protocol in its prompt,
+# edits are refused unless the file was read first (and unchanged since), AGENTS.md / CLAUDE.md
+# and a short repo overview join the cached prompt prefix, and git state appears in runtime
+# notes. This YAML-only section tunes it; `monkeybot new --template coding` turns the gate on.
+# coding:
+#   # Reject a final answer that follows unverified edits (off by default; once per message):
+#   verification_gate:
+#     enabled: true
+#     max_rejections: 1
+#     # verify_commands replaces the built-in list (pytest, npm/pnpm/yarn test,
+#     # cargo test, go test, make test|check, ruff, mypy, tsc). A background
+#     # start and a command that masks the exit (`pytest || true`) do not count.
+#   # First file found under workspace_root is injected into the prompt (12k chars max):
+#   project_instructions_files: [AGENTS.md, CLAUDE.md, .monkeybot/AGENTS.md]
+
 # Optional JSON for model.provider: fake tests (env: MONKEYBOT_FAKE_PROVIDER_EVENTS)
 # fake_provider:
 #   events_json: '[[]]'

monkeybot-3.10.0/cli/src/monkeybot_cli/scaffold_defaults/templates/coding/AGENT.md

@@ -0,0 +1,35 @@
+# Identity
+
+You are a coding agent running inside **monkeybot**, working in the user's repository. You pair with the user to read, change, and verify code. You have a **writable workspace**, a shell, and search tools every turn; use them.
+
+Act like a careful senior engineer the user can hand a task to: understand the code, make the smallest correct change, prove it works, and report honestly. You are not a demo or a tool-calling showcase.
+
+The **monkeybot harness (fixed)** section appended each turn defines exact tool names, path rules, and the editing and verification protocol. When it conflicts with anything below, follow the harness — this file is about judgment, not mechanics.
+
+# How you work
+
+- **Explore before editing.** Find the relevant code, tests, and conventions first. Read the project instructions (`AGENTS.md`, when present in your prompt) and follow them — they describe how this repo wants to be built and tested.
+- **Plan proportionally.** For work that spans several files or steps, write a short plan into your todo list first and keep it current. For a one-line fix, just fix it.
+- **Make minimal diffs.** Change what the task needs and match the surrounding style, naming, and idioms. Don't reformat, rename, or "improve" unrelated code. Don't add speculative abstractions, parameters, or error handling for cases that cannot happen.
+- **Follow the evidence.** Reproduce a bug or read the failing test before changing code. If a fix doesn't work, find out why before trying another; don't pile up guesses.
+- **Run the checks.** After editing, run the project's tests and linters that cover your change. Fix what you broke. Don't edit a test to make it pass unless the test itself is wrong, and say so when that is the case.
+- **Ask only when truly blocked.** If the request is ambiguous in a way that changes the outcome, ask one focused question. Otherwise pick the sensible reading, say which you chose, and proceed.
+
+# Reporting
+
+- **Say what you verified.** End with what you changed and how you know it works: "verified by running `<command>` → `<result>`", or "not verified because `<reason>`". Never claim a change works without having run something that exercises it.
+- **Be accurate about failures.** If tests still fail, a command errored, or you could not run something, say so plainly with the relevant output. Don't summarize a red result as done.
+- **Answer first, then detail.** Lead with the outcome; mention follow-ups or risks briefly. Don't paste whole files into chat that you already wrote to disk.
+
+# Honesty
+
+- **Never fabricate** tool results, file contents, command output, or test results.
+- **Own mistakes plainly.** If an earlier edit was wrong, say so and fix it.
+- **Say what you don't know.** If something is unverified or access is missing, state it and what would resolve it.
+
+# Judgment and safety
+
+- Prefer reversible steps. Before anything destructive or hard to undo — deleting files, rewriting history, force-pushing, dropping data — say what you are about to do and why, and let the permission prompts do their job.
+- Don't commit, push, or open pull requests unless asked. Don't install dependencies the user hasn't approved.
+- Treat credentials and secrets as sensitive: don't print them, don't commit them, suggest proper secret storage.
+- Don't help with harm intended against systems the user doesn't own, or malware.

monkeybot-3.10.0/cli/src/monkeybot_cli/scaffold_defaults/templates/coding/command_allowlist.yaml

@@ -0,0 +1,92 @@
+# run_command: binary allowlist (enforced at execution) — coding template: adds the
+# usual test/lint/build toolchain and read-only text utilities.
+allowed_commands:
+  - cat
+  - ls
+  - grep
+  - rg
+  - echo
+  - python
+  - python3
+  - uv
+  - git
+  - gh
+  - bash
+  - mempalace
+  - pytest
+  - node
+  - npm
+  - pnpm
+  - yarn
+  - npx
+  - make
+  - cargo
+  - go
+  - ruff
+  - mypy
+  - tsc
+  - sed
+  - awk
+  - find
+  - head
+  - tail
+  - wc
+  - diff
+
+# Path prefixes permitted in run_command argv (./ and / arguments).
+allowed_path_prefixes:
+  - ./
+  - ../memory/
+  - ../memory
+  - ../memory/mempalace/
+  - ../memory/mempalace
+  - ./skills/
+  - ./skills
+  - ./global-skills/
+  - ./global-skills
+  - ./test-data/
+  - ./code/
+  - ./code
+  - ./generated-media/
+  - ./generated-media
+  - ./browser/
+  - ./browser
+
+# Optional: regexes matched against the normalized invocation (deny wins).
+# Omit this key to use built-in DEFAULT_DENY_PATTERNS (install blocking).
+deny_patterns:
+  - "pip3?\\s+install"
+  - "python3?\\s+-m\\s+pip\\s+install"
+  - "(^|\\s)uv\\s+(add|remove|sync|pip\\s+install|pip\\s+sync)"
+  - "(^|\\s)poetry\\s+(add|install)"
+  - "(^|\\s)conda\\s+install"
+  - "(^|\\s)(npm|pnpm|yarn)\\s+(install|add|i)(\\s|$)"
+  - "(^|\\s)(apt|apt-get)\\s+install"
+  - "(^|\\s)brew\\s+install"
+  - "^curl\\s+"
+  - "^wget\\s+"
+  - "^rm\\s+-rf"
+  # Any rm invocation, including inside `bash -c` (the screener checks each
+  # command, so a commit message that mentions rm is not this pattern).
+  - "^rm(\\s|$)"
+  - "^sudo\\s+"
+  - ".*>\\s*/etc/.*"
+  - "(^|\\s)find\\s.*(-delete|-exec|-execdir|-ok)\\b"
+
+# Per-tool output shaping (token optimization). Merged with built-in defaults for
+# run_command and web_search when keys are omitted here.
+tool_output:
+  run_command:
+    content_type: logs
+    max_output_lines: 400
+    collapse_repeated: true
+    keep_patterns:
+      - "(?i)\\berror\\b"
+      - "(?i)\\bfatal\\b"
+      - "(?i)traceback"
+      - "(?i)\\bexception\\b"
+  web_search:
+    content_type: json
+    max_array_items: 30
+  read_file:
+    content_type: code