[Eduard van Valkenburg (eavanvalkenburg)]

Motivation & Context

Keep Monty's returned file attachments predictable when an execution writes to one or more read-write mounts. Apply shared file-count and raw-byte budgets before reading and encoding attachments, while preserving the existing path checks and captures that fit.

Description & Review Guide

• What are the major changes? Limit capture to 20 files and 20 MiB of raw data per execution across all read-write mounts, retaining the 5 MiB per-file limit. Bound descriptor reads, recheck file sizes, account for actual bytes read, and return one omission summary. Add boundary and file-growth regressions, and update model-visible instructions, the package README, and consumer integration guidance.
• What is the impact of these changes? Captures within the limits retain their contents and path annotations. Empty files consume a file slot, exact fits remain valid, and smaller files can still fit after an oversized candidate is skipped. Omission does not undo filesystem writes. The limits apply to attachment capture, not disk use, traversal, or all host memory.
• What do you want reviewers to focus on? Cross-mount accounting, admission before reading or encoding, bounded reads during file growth, descriptor cleanup, and preservation of the existing path and junction checks.

Related Issue

N/A - focused correction to Monty's existing file-capture behavior. No competing pull request was found.

AI Assistance

• No material AI assistance was used.
• This is an AI-assisted contribution. I reviewed, understood, and verified all submitted content and accept responsibility for it.

AI assistance details: Implementation, regression tests, documentation, and this pull request description.

Contribution Checklist

• The code builds clean without any errors or warnings
  From python/, with UV_NO_PROGRESS=1: uv run --no-sync poe build -P monty passed; uv run --no-sync poe syntax -P monty -C passed; uv run --no-sync poe typing -P monty passed, including strict source Pyright and all five test checkers.
• All unit tests pass, and I have added new tests where possible
  From python/, with UV_NO_PROGRESS=1: uv run --no-sync poe test -P monty passed with 181 passed, 2 Windows-only skips, and 91% package coverage. PYTHONDONTWRITEBYTECODE=1 uv run --no-sync python -B -m pytest -m integration --import-mode=importlib --no-cov -p no:cacheprovider packages/monty/tests/monty/test_monty_codeact_integration.py::test_workspace_root_writes_are_captured_as_content --tb=short passed with 1 test. Workspace-wide tests and Windows-native junction tests were not run.
• The PR follows the Contribution Guidelines
• This PR links to an agreed issue with no competing open PR, or the Related Issue section documents a trivial-change or repository-automation exception.
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[Copilot]

🟢 Approval recommended

No active review issues remain for the changes that bound Monty’s post-execution file attachments.

No open issues 🎉

What changed in this PR

This PR bounds Monty’s post-execution file attachments across read-write mounts while preserving existing path validation and captures that fit within the limits.

Changes:

• Enforces shared limits of 20 files and 20 MiB of raw data per execution, retaining the 5 MiB per-file limit.
• Bounds reads, accounts for actual bytes captured, and consolidates limit-related omissions into one summary.
• Adds boundary and file-growth regression tests and documents the distinction between attachment limits and interpreter resource limits.

File	Description
skills/​agent-framework-builder-python/​references/​integrations.md	Adds Monty attachment-limit guidance for consumers.
python/​packages/​monty/​tests/​monty/​test_monty_codeact.py	Tests shared budgets, boundary cases, file growth, and descriptor cleanup.
python/​packages/​monty/​README.md	Documents capture limits, omission behavior, and resource-limit scope.
python/​packages/​monty/​agent_framework_monty/​_instructions.py	Informs the model about shared capture limits and omission summaries.
python/​packages/​monty/​agent_framework_monty/​_execute_code_tool.py	Implements capture budgets, bounded reads, and consolidated omission reporting.

_{Review effort: Balanced}

[github-actions]

MAF Automated Review — Iteration 1

Result: No findings
Scope: full PR (1 commit(s)): 381c3f4c7d49
Model: gpt-5.6-sol

Overview

The PR adds invocation-local file-count and raw-byte budgets while retaining the existing per-file limit, path validation, and read-write-mount filtering. Bounded descriptor reads, actual-byte accounting, unconditional descriptor cleanup, and focused boundary, cross-mount, growth, and path-race tests provide strong guardrails. No publishable Critical, High, or Medium defect introduced by this change was established.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.

[github-actions]

MAF Automated Review — Iteration 2

Result: No findings
Scope: 1 net-new commit(s): 04b249073fda
Model: gpt-5.6-sol

Overview

This incremental iteration replaces explicit send and return type arguments with the equivalent shorthand on a test-local generator. Postponed annotation evaluation, existing repository precedent, and the unchanged single-yield context-manager implementation constrain compatibility risk across supported Python versions. Production capture behavior and its descriptor, identity, and bounded-read guards are unchanged, so no publishable defect is introduced.

Reviewed the supplied incremental change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.