agents-city 0.1.0

package/plugin/scripts/city-session.sh

@@ -0,0 +1,552 @@
+#!/usr/bin/env bash
+# Build somebody's tmux session out of their card:
+#   window "seat" -> this city's stable address, sitting in the city folder
+#   window N      -> one repo support agent, on its configured runtime
+#
+#   city-session.sh [user] [--claude] [--no-sync] [--no-yolo] [--only r1,r2]
+#
+# The repos on your card are looked for across the whole disk: they do not have
+# to live in one folder, and the folder does not have to be named after the repo.
+#
+# Without --claude it just opens shells. With it, each window starts the
+# runtime configured for that city member (Claude, Codex, OpenCode, or custom).
+#
+# The permissions are NOT the same in every window, and that is the point:
+#
+#   the "seat" window -> NO bypass. It receives text from connected cities, and
+#                        there the confirmations are the only door.
+#   repo windows      -> bypass on (yolo). Your repos on your machine, and
+#                        nothing from outside comes in through them. --no-yolo
+#                        turns it off.
+#
+# Repo agents do not message one another. Every runtime receives assignments
+# through the same authenticated local WebSocket bus; the seat chairs the turns.
+
+set -uo pipefail
+
+USUARIO=""
+RUN_CLAUDE=0
+DO_SYNC=1
+YOLO=1
+SOLO=""
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    -c|--claude)  RUN_CLAUDE=1; shift ;;
+    -n|--no-sync) DO_SYNC=0; shift ;;
+    --no-yolo)    YOLO=0; shift ;;
+    --only)       SOLO="${2:-}"; shift 2 ;;
+    -h|--help)    sed -n '2,24p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
+    -*) echo "Unknown option: $1" >&2; exit 1 ;;
+    *)  USUARIO="$1"; shift ;;
+  esac
+done
+
+# ── The selected city, where its one owner card lives ──────────────────────
+# Resolve it through the same owner as seat, hall, hooks and the road channel.
+# An explicit AGENTS_CITY_DATA still wins inside city-env.sh.
+. "$(dirname "$0")/city-env.sh"
+EQUIPO="${AGENTS_CITY_DATA:-}"
+if [ ! -d "$EQUIPO" ]; then
+  echo "I cannot resolve the selected city." >&2
+  echo "Create one with agents-city setup, or select one with agents-city cities use <city>." >&2
+  exit 1
+fi
+
+# ── Who ────────────────────────────────────────────────────────────────────
+if [ -z "$USUARIO" ]; then USUARIO="${AGENTS_CITY_USER:-}"; fi
+FICHA="$EQUIPO/$USUARIO.md"
+if [ ! -f "$FICHA" ]; then
+  echo "There is no card for '$USUARIO' in $EQUIPO." >&2
+  fichas=""
+  for f in "$EQUIPO"/*.md; do
+    case "$(basename "$f")" in README*|AGENTS*) ;; *) fichas="$fichas $(basename "$f" .md)" ;; esac
+  done
+  echo "Cards there:$fichas" >&2
+  echo "Say who you are:  $(basename "$0") <user>" >&2
+  exit 1
+fi
+
+# ── The card: agent and repos ──────────────────────────────────────────────
+LEER="$(dirname "$0")/read-card.py"
+RUNTIME="$(dirname "$0")/city-runtime.sh"
+LAUNCHPY="$(dirname "$0")/launch.py"
+CHANNEL_CLIENT="$(dirname "$0")/../channel/client.js"
+# `agent`, which is what every card actually carries. A v1 reader once asked for
+# `agente`, got nothing every single time,
+# and fell through to the default below: so the seat window never carried anybody's
+# role, and the architect sat on the bus as <user>/dev. The fallback hid it.
+#
+# One call, because card.py accepts `agente` as an alias for a hand-written card.
+AGENTE="$(python3 "$LEER" "$FICHA" agent)"
+REPOS_RAW="$(python3 "$LEER" "$FICHA" repos)"
+[ -z "$AGENTE" ] && AGENTE="$(python3 "$(dirname "$0")/cities.py" address "$USUARIO" "$EQUIPO")"
+
+[ -n "$SOLO" ] && REPOS_RAW="$SOLO"
+
+CODE_DIR="${CITY_CODE_DIR:-$HOME/codigo}"
+# The session's name comes from cities.py, not from a rule of our own: in the
+# every city it carries owner and city — so two local seats never fight over one
+# tmux session, including the first city named `home`.
+SESSION="$(python3 "$(dirname "$0")/cities.py" sesion "$USUARIO" "$EQUIPO")"
+[ -z "$SESSION" ] && SESSION="$USUARIO"
+ADDRESS="$(python3 "$(dirname "$0")/cities.py" address "$USUARIO" "$EQUIPO")"
+# Claude session names are machine-global. The old literal `seat` meant opening a
+# second local city could address or replace the first one's seat by accident.
+SEAT_NAME="$SESSION"
+
+if tmux has-session -t "$SESSION" 2>/dev/null; then
+  echo "Session '$SESSION' is already up — attaching."
+  exec tmux attach -d -t "$SESSION"
+fi
+
+# Claude's native cross-session path is explicitly closed. The city bus is the
+# only route, so Claude, Codex, OpenCode and Kimi obey the same topology.
+# skipDangerousModePermissionPrompt only suppresses Claude's local yolo notice.
+SETTINGS='{"crossSessionInbound":"refuse","skipDangerousModePermissionPrompt":true}'
+NO_PEER_TOOLS=' --disallowed-tools SendMessage,ListAgents'
+YOLO_FLAG=""
+[ "$YOLO" -eq 1 ] && YOLO_FLAG=" --dangerously-skip-permissions"
+
+# Whether the chair itself runs yolo. A per-city decision written in city.yml
+# (`seat_yolo: 1`, set at setup or with `agents-city seat --seat-yolo on`):
+# locally the seat is the owner's own hands on the owner's own machine, and an
+# owner who trusts that should not be asked for permission by their own chair.
+# The default stays off, and --no-yolo remains the session-wide brake for both.
+SEAT_YOLO="$(python3 "$(dirname "$0")/cities.py" clave "$EQUIPO" seat_yolo 2>/dev/null || true)"
+[ "$YOLO" -eq 0 ] && SEAT_YOLO=0
+SEAT_AUTO=0
+SEAT_YOLO_FLAG=""
+if [ "${SEAT_YOLO:-0}" = "1" ]; then
+  SEAT_AUTO=1
+  SEAT_YOLO_FLAG=" --dangerously-skip-permissions"
+fi
+
+# Claude authentication can also arrive through the parent shell/tmux server.
+# A stale CLAUDE_CODE_OAUTH_TOKEN (or API/gateway variable) takes precedence
+# over the owner's healthy Claude.ai login and makes a Team/Max account appear
+# as "Claude API" with no usage credits. Never delete or rewrite credentials:
+# when a stored Claude.ai login works, remove provider overrides only from each
+# city child process. Owners intentionally using environment auth can keep it
+# with CITY_CLAUDE_AUTH=environment.
+claude_auth_prefix() {
+  [ "${CITY_CLAUDE_AUTH:-auto}" = environment ] && return 0
+  command -v claude >/dev/null 2>&1 || return 0
+  local estado
+  estado="$(env \
+    -u CLAUDE_CODE_OAUTH_TOKEN \
+    -u ANTHROPIC_API_KEY \
+    -u ANTHROPIC_AUTH_TOKEN \
+    -u ANTHROPIC_BASE_URL \
+    -u CLAUDE_CODE_USE_BEDROCK \
+    -u CLAUDE_CODE_USE_VERTEX \
+    -u CLAUDE_CODE_USE_FOUNDRY \
+    claude auth status 2>/dev/null || true)"
+  if printf '%s' "$estado" | grep -Eq '"loggedIn"[[:space:]]*:[[:space:]]*true' \
+     && printf '%s' "$estado" | grep -Eq '"authMethod"[[:space:]]*:[[:space:]]*"claude\.ai"'; then
+    printf '%s' 'env -u CLAUDE_CODE_OAUTH_TOKEN -u ANTHROPIC_API_KEY -u ANTHROPIC_AUTH_TOKEN -u ANTHROPIC_BASE_URL -u CLAUDE_CODE_USE_BEDROCK -u CLAUDE_CODE_USE_VERTEX -u CLAUDE_CODE_USE_FOUNDRY '
+  fi
+}
+CLAUDE_AUTH_PREFIX=""
+[ "$RUN_CLAUDE" -eq 1 ] && CLAUDE_AUTH_PREFIX="$(claude_auth_prefix)"
+
+# The cage. Yolo answers "does the agent ask permission?"; the cage answers
+# "what can it touch?". They are independent, so yolo stays and each repo
+# window is wrapped in a per-window macOS seatbelt profile: writes only in its
+# own repo and runtime state, and the credential files (`~/.ssh`,
+# `~/.git-credentials`, gh/cloud configs) sealed at the kernel. On a machine
+# without seatbelt, or with CITY_CAGE=0, the prefix is empty and nothing
+# changes. The seat is deliberately NOT caged: it is the permissioned side.
+CAGE="$(dirname "$0")/cage.py"
+BROKERPY="$(dirname "$0")/broker.py"
+WORKSPACE="$(dirname "$0")/workspace.py"
+# On Linux the cage is a bubblewrap namespace, and deciding whether the kernel
+# will grant one means actually building one. `cage.py` runs as a fresh process
+# per window, so without this the probe is paid once per agent instead of once
+# per city — and on a kernel that refuses namespaces, paid slowly. Ask once,
+# hand the answer to every window.
+if [ -z "${CITY_CAGE_BWRAP:-}" ] && [ "$(uname -s)" = "Linux" ]; then
+  if python3 "$CAGE" check >/dev/null 2>&1; then
+    CITY_CAGE_BWRAP=1
+  else
+    CITY_CAGE_BWRAP=0
+  fi
+  export CITY_CAGE_BWRAP
+fi
+
+jaula_de() {  # window, cwd, [broker token file], [colon-joined mount targets] -> prefix or ''
+  local args=(line --window "$1" --repo "$2") salida estado
+  [ -n "${3:-}" ] && args+=(--token-file "$3")
+  [ -n "${4:-}" ] && args+=(--mounts "$4")
+  salida="$(python3 "$CAGE" "${args[@]}" 2>&1)"; estado=$?
+  # An empty prefix is a normal answer: no cage on this machine, or CITY_CAGE=0.
+  # A FAILURE is not — a working directory that covers a sealed root is refused
+  # on purpose, and swallowing that refusal launched the window uncaged and
+  # silent, which is the one outcome nobody would notice.
+  if [ $estado -ne 0 ]; then
+    printf '  %s launches WITHOUT a cage: %s\n' "$1" "$salida" >&2
+    return 0
+  fi
+  printf '%s' "$salida"
+}
+
+# Which model and effort a window's agent starts with. Three voices, in order:
+# this launch's flags (CITY_MODEL/CITY_EFFORT, set by `seat --model/--effort`),
+# then the card's per-window key (`model.dbt:`), then the card's default
+# (`model:`). Nothing set means no flag at all — the owner's Claude default,
+# which is the right silence.
+motor_de() {  # $1 = window name -> prints the extra claude flags
+  local ventana="$1" modelo esfuerzo salida=""
+  modelo="${CITY_MODEL:-$(python3 "$LEER" "$FICHA" "model.$ventana")}"
+  [ -z "$modelo" ] && modelo="$(python3 "$LEER" "$FICHA" model)"
+  esfuerzo="${CITY_EFFORT:-$(python3 "$LEER" "$FICHA" "effort.$ventana")}"
+  [ -z "$esfuerzo" ] && esfuerzo="$(python3 "$LEER" "$FICHA" effort)"
+  [ -n "$modelo" ] && salida=" --model $modelo"
+  [ -n "$esfuerzo" ] && salida="$salida --effort $esfuerzo"
+  printf '%s' "$salida"
+}
+
+runtime_de() {  # configured command -> claude | codex | opencode | kimi | terminal | unknown
+  local raw="$1" first
+  case "$raw" in terminal:*) printf 'terminal'; return ;; esac
+  first="${raw%% *}"
+  first="${first##*/}"
+  case "$first" in
+    claude|claude-code) printf 'claude' ;;
+    codex) printf 'codex' ;;
+    opencode) printf 'opencode' ;;
+    kimi|kimi-code) printf 'kimi' ;;
+    *) printf 'unknown' ;;
+  esac
+}
+
+gateway_line() {  # actor, cwd, full runtime command, optional auto-approve
+  printf '%q ' "$RUNTIME" gateway "$1" "$2" "$3" "${4:-$YOLO}"
+}
+
+# Terminal emulators and tmux both have finite input queues. Sending a 1-2 KB
+# shell program as simulated keystrokes can cut it at an arbitrary byte (we saw
+# `--da`, `--dangerously`, and even a lone `-`). Put the exact command in a
+# private launcher and type only its short path into the pane.
+lanza() {  # tmux target, actor, cwd, full command
+  local target="$1" actor="$2" cwd="$3" command="$4" launcher typed
+  launcher="$(python3 "$LAUNCHPY" create --data "$EQUIPO" --actor "$actor" \
+    --cwd "$cwd" --client "$CHANNEL_CLIENT" --command "$command")" || return 1
+  printf -v typed '%q' "$launcher"
+  tmux send-keys -t "$target" -l -- "$typed"
+  tmux send-keys -t "$target" C-m
+}
+
+# ── Claude windows start one at a time ─────────────────────────────────────
+# Every Claude session on a machine shares one OAuth credential, and refreshing
+# it rotates a single-use refresh token: the first process to refresh wins and
+# the rest are left holding one the server has already invalidated. It does not
+# read as an auth problem — it reads as "you have no quota left" on an account
+# with plenty, and nothing but logging out and back in clears it. Upstream has
+# had it reported many times over (claude-code#24317, #25609, #27933, #48786).
+#
+# One window per repo makes this the worst possible caller: eighteen sessions
+# starting in the same millisecond, all refreshing at once. So the seat's Claude
+# goes first and alone, and every repo window holds its own shell for a moment
+# before starting. The wait happens INSIDE the window, so attaching is still
+# instant and you watch the agents wake one by one; it also spaces out eighteen
+# simultaneous `git fetch`es, which were their own small storm.
+#
+# What this does not fix: a token that expires at four in the afternoon expires
+# for every session already open. That one is upstream's, not ours.
+#
+#   CITY_SETTLE=0 CITY_STAGGER=0    everything at once, as it was before
+entero() {  # $1 = value, $2 = fallback. A typo must not crash somebody's day.
+  case "$1" in
+    '' | *[!0-9]*) printf '%s' "$2" ;;
+    *) printf '%s' "$1" ;;
+  esac
+}
+SETTLE="$(entero "${CITY_SETTLE-}" 8)"
+STAGGER="$(entero "${CITY_STAGGER-}" 1)"
+
+# Seconds the Nth repo window waits. The first carries the whole settle, because
+# it is the one that would collide with the seat's refresh; after that a token is
+# already fresh in the store and the rest only need to not arrive as a herd. A
+# negative turn means nobody has refreshed yet — the seat runs something else, so
+# this window IS the first Claude and has nothing to wait for.
+retraso() {  # $1 = claude repo windows already scheduled
+  if [ "$1" -lt 0 ]; then printf '0'; else printf '%s' "$((SETTLE + $1 * STAGGER))"; fi
+}
+
+sync_line() {
+  [ "$DO_SYNC" -eq 1 ] || return 0
+  printf '%s' 'if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then git fetch origin -q --prune 2>/dev/null; b=$(for x in main master; do git show-ref -q --verify refs/remotes/origin/$x && echo $x && break; done); [ -n "$b" ] && { git checkout -q "$b" 2>/dev/null; git pull --ff-only -q origin "$b" 2>/dev/null && echo "  ✓ $b up to date" || echo "  ⚠ could not update"; } || echo "  · no main/master on origin"; fi; '
+}
+
+# ── tmux comforts ──────────────────────────────────────────────────────────
+# Applied to the tmux server, not to anybody's ~/.tmux.conf: this does not touch
+# your configuration. They are additions, so they sit alongside whatever you run.
+comodidades() {
+  # Mouse: click a window name in the bar to switch, click a pane to focus it,
+  # wheel for the scrollback.
+  tmux set-option -g mouse on 2>/dev/null
+
+  # Windows numbered from 1, so Alt+1 is the first one and not the second.
+  tmux set-option -g base-index 1 2>/dev/null
+  tmux set-option -g renumber-windows on 2>/dev/null
+
+  # Alt+1..9 jumps to that window, no prefix.
+  for n in 1 2 3 4 5 6 7 8 9; do
+    tmux bind-key -n "M-$n" select-window -t "$n" 2>/dev/null
+  done
+  # Alt+left / Alt+right to move in order.
+  tmux bind-key -n M-Left  previous-window 2>/dev/null
+  tmux bind-key -n M-Right next-window 2>/dev/null
+
+  # Make the status bar say where you are.
+  tmux set-option -g status on 2>/dev/null
+  tmux set-option -g status-left '[#S] ' 2>/dev/null
+  tmux set-option -g status-left-length 20 2>/dev/null
+  tmux set-option -g window-status-current-style 'bg=colour4,fg=black,bold' 2>/dev/null
+
+  # Which window wants you. With one agent per repo you are looking at one window
+  # and five are working, so the useful signal is not "what is on screen" but
+  # "which tab needs me". Claude rings the terminal bell when it is waiting on you,
+  # so bell is what means come here: that tab turns red and stays red until you
+  # visit it. Activity is the softer one — output moved — and only underlines.
+  #
+  # No plugin manager and no third-party plugins for this: it is a handful of tmux
+  # options, and installing somebody else's tmux config to get a coloured tab is a
+  # bad trade.
+  #
+  # `-gw`, not `-g`. These four are *window* options, and setting them as server
+  # options fails — silently, because of the 2>/dev/null. Half of this block was
+  # doing nothing at all: monitor-activity stayed off and the styles stayed default.
+  tmux set-option -gw monitor-bell on 2>/dev/null
+  tmux set-option -gw monitor-activity on 2>/dev/null
+  tmux set-option -gw window-status-bell-style 'fg=colour231,bg=colour160,bold' 2>/dev/null
+  tmux set-option -gw window-status-activity-style 'fg=colour222,underscore' 2>/dev/null
+  # Session options: where the bell is allowed to come from, and no flashing bar
+  # over the pane you are reading.
+  tmux set-option -g bell-action other 2>/dev/null
+  tmux set-option -g visual-bell off 2>/dev/null
+  tmux set-option -g visual-activity off 2>/dev/null
+  # A clock, so a frozen status bar is visibly frozen. tmux expands strftime itself,
+  # so this needs no shell — `#(date ...)` here spawns a process every interval and
+  # was being written with a printf-escaped %% that tmux never understood.
+  tmux set-option -g status-interval 5 2>/dev/null
+  tmux set-option -g status-right ' %H:%M ' 2>/dev/null
+  tmux set-option -g status-right-length 12 2>/dev/null
+}
+
+# ── Work out where each agent works ────────────────────────────────────────
+# Agents come first. A card that declares `agents:` drives the agent-first
+# model: each agent's cwd is its workspace folder, and its mounts (symlinks to
+# repos, worktrees or document folders) become the extra writable roots the
+# cage allows. A legacy card with only `repos:` takes the path below, unchanged
+# — every repo is still an agent whose one mount is that repo.
+LOCALIZA="$(dirname "$0")/find-repos.sh"
+faltan=()
+RUTAS=()
+NOMBRES=()
+MONTAJES=()
+AGENTS_RAW="$(python3 "$LEER" "$FICHA" agents 2>/dev/null || true)"
+
+if [ -n "$AGENTS_RAW" ] && [ -z "$SOLO" ]; then
+  # Agent-first: one `sync-all` pass reads the card once, materialises every
+  # agent's workspace and mounts, and emits `slug<TAB>cwd<TAB>targets` per line —
+  # so the whole city costs one interpreter start and one card parse, not N+1.
+  while IFS=$'\t' read -r slug cwd targets; do
+    [ -z "$slug" ] && continue
+    RUTAS+=("$cwd")
+    NOMBRES+=("$slug")
+    MONTAJES+=("$targets")
+    # stderr is left attached so workspace.py's "skipping mount <x>" warnings
+    # reach the owner — a typo'd or missing mount source must not degrade in
+    # silence, the way the legacy path reports missing repos via `faltan`.
+  done < <(python3 "$WORKSPACE" sync-all --data "$EQUIPO" --card "$FICHA")
+else
+  REPOS=()
+  # bash 3.2 — the one macOS ships — blows up on "${REPOS[@]}" when it is empty.
+  [ -n "$REPOS_RAW" ] && IFS=',' read -ra REPOS <<< "$REPOS_RAW"
+  for r in ${REPOS[@]+"${REPOS[@]}"}; do
+    r="$(echo "$r" | xargs)"; [ -z "$r" ] && continue
+    # 1) the usual place; 2) wherever you keep it, found by its remote.
+    path="$CODE_DIR/$r"
+    [ -d "$path" ] || path="$("$LOCALIZA" "$r" 2>/dev/null)"
+    if [ -z "$path" ] || [ ! -d "$path" ]; then faltan+=("$r"); continue; fi
+    RUTAS+=("$path")
+    # One canonical slug is also the tmux name, engine-key suffix and bus actor.
+    NOMBRES+=("$(python3 "$LEER" --window "$r")")
+    MONTAJES+=("")
+  done
+fi
+
+# Trust every folder up front, so no window sits waiting on the dialog.
+python3 "$(dirname "$0")/trust-repos.py" "$EQUIPO" ${RUTAS[@]+"${RUTAS[@]}"}
+
+# ── The seat window: this city's identity on its roads ─────────────────────
+"$RUNTIME" ensure >/dev/null
+comodidades
+tmux new-session -d -s "$SESSION" -n seat -c "$EQUIPO"
+
+# Where the cards live, told to the session rather than assumed.
+#
+# A window inherits the environment of the tmux *server*, not of whoever ran this.
+# So on any machine where a tmux server was already up, AGENTS_CITY_DATA never
+# reached the windows and the plugin inside them looked for the cards in the
+# default place. Set on the session, and also written in front of each command
+# below, because the two cost nothing and the failure is silent.
+tmux set-environment -t "$SESSION" AGENTS_CITY_DATA "$EQUIPO" 2>/dev/null
+tmux set-environment -t "$SESSION" AGENTS_CITY_HOME "${AGENTS_CITY_HOME:-$HOME/.agents-city}" 2>/dev/null
+tmux set-environment -t "$SESSION" AGENTS_CITY_USER "$USUARIO" 2>/dev/null
+tmux set-environment -t "$SESSION" CITY_ADDRESS "$ADDRESS" 2>/dev/null
+tmux set-environment -t "$SESSION" CITY_SEAT_NAME "$SEAT_NAME" 2>/dev/null
+
+# The seat runs Claude unless the card says otherwise. `runs.seat` is the same key
+# the repo windows use, and it makes a city with no Claude in it possible at all:
+# what that seat gives up is the `/city:` commands, which are Claude's, and what it
+# keeps is the folder, the identity, and everything the terminal does.
+SEAT_OTRO="$(python3 "$LEER" "$FICHA" "runs.seat")"
+turno=0
+[ -n "$SEAT_OTRO" ] && [ "$(runtime_de "$SEAT_OTRO")" != claude ] && turno=-1
+# If the seat runs another engine, the first repo window is the first Claude.
+if [ "$RUN_CLAUDE" -eq 1 ]; then
+  if [ -n "$SEAT_OTRO" ]; then
+    SEAT_RUNTIME="$(runtime_de "$SEAT_OTRO")"
+    if [ "$SEAT_RUNTIME" = claude ]; then
+      CLAUDE_SEAT="$SEAT_OTRO --name $SEAT_NAME --settings '$SETTINGS'$NO_PEER_TOOLS$SEAT_YOLO_FLAG"
+      lanza "$SESSION:seat" seat "$EQUIPO" \
+        "$(sync_line)AGENTS_CITY_DATA=$EQUIPO AGENTS_CITY_HOME=${AGENTS_CITY_HOME:-$HOME/.agents-city} AGENTS_CITY_USER=$USUARIO CITY_ADDRESS=$ADDRESS CITY_SEAT_NAME=$SEAT_NAME CITY_BUS_ACTOR=seat CITY_RUNTIME_KIND=seat CITY_BUS_AGENT=$AGENTE ${CLAUDE_AUTH_PREFIX}$(gateway_line seat "$EQUIPO" "$CLAUDE_SEAT" "$SEAT_AUTO")"
+    elif [ "$SEAT_RUNTIME" = codex ] || [ "$SEAT_RUNTIME" = opencode ] || [ "$SEAT_RUNTIME" = kimi ]; then
+      lanza "$SESSION:seat" seat "$EQUIPO" \
+        "$(sync_line)AGENTS_CITY_DATA=$EQUIPO AGENTS_CITY_HOME=${AGENTS_CITY_HOME:-$HOME/.agents-city} AGENTS_CITY_USER=$USUARIO CITY_ADDRESS=$ADDRESS CITY_SEAT_NAME=$SEAT_NAME CITY_BUS_ACTOR=seat CITY_RUNTIME_KIND=seat CITY_BUS_AGENT=$AGENTE $(gateway_line seat "$EQUIPO" "$SEAT_OTRO" "$SEAT_AUTO")"
+    elif [ "$SEAT_RUNTIME" = terminal ]; then
+      SEAT_COMMAND="${SEAT_OTRO#terminal:}"
+      lanza "$SESSION:seat" seat "$EQUIPO" \
+        "$(sync_line)AGENTS_CITY_DATA=$EQUIPO AGENTS_CITY_HOME=${AGENTS_CITY_HOME:-$HOME/.agents-city} AGENTS_CITY_USER=$USUARIO CITY_ADDRESS=$ADDRESS CITY_SEAT_NAME=$SEAT_NAME CITY_BUS_ACTOR=seat CITY_RUNTIME_KIND=seat CITY_BUS_AGENT=$AGENTE $SEAT_COMMAND"
+      "$RUNTIME" fallback seat "$SESSION:seat" "${SEAT_COMMAND%% *}"
+    else
+      tmux send-keys -t "$SESSION:seat" \
+        "echo 'No native Agents City gateway for: $SEAT_OTRO. Use terminal:$SEAT_OTRO only if you explicitly accept terminal injection.'" C-m
+    fi
+  else
+    CLAUDE_SEAT="claude --name $SEAT_NAME$(motor_de seat) --settings '$SETTINGS'$NO_PEER_TOOLS$SEAT_YOLO_FLAG"
+    lanza "$SESSION:seat" seat "$EQUIPO" \
+      "$(sync_line)AGENTS_CITY_DATA=$EQUIPO AGENTS_CITY_HOME=${AGENTS_CITY_HOME:-$HOME/.agents-city} AGENTS_CITY_USER=$USUARIO CITY_ADDRESS=$ADDRESS CITY_SEAT_NAME=$SEAT_NAME CITY_BUS_ACTOR=seat CITY_RUNTIME_KIND=seat CITY_BUS_AGENT=$AGENTE ${CLAUDE_AUTH_PREFIX}$(gateway_line seat "$EQUIPO" "$CLAUDE_SEAT" "$SEAT_AUTO")"
+  fi
+fi
+
+# The broker, opt-in with CITY_BROKER=1: caged windows cannot read the gh
+# token — on purpose — so PRs and pushes go through a small owner-side process
+# that validates (declared repo only, never the default branch) and audits.
+# Each window gets its own token file, and its cage re-allows exactly that one.
+BROKER_URL=""
+if [ "${CITY_BROKER:-0}" = "1" ]; then
+  python3 "$BROKERPY" stop --data "$EQUIPO" >/dev/null 2>&1 || true
+  nohup python3 "$BROKERPY" serve --data "$EQUIPO" >/dev/null 2>&1 &
+  for _ in 1 2 3 4 5 6 7 8 9 10; do
+    BROKER_URL="$(python3 "$BROKERPY" url --data "$EQUIPO" 2>/dev/null || true)"
+    [ -n "$BROKER_URL" ] && break
+    sleep 0.3
+  done
+  [ -z "$BROKER_URL" ] && echo "WARNING: the credential broker did not start; windows launch without it." >&2
+fi
+
+# ── One window per repo, reachable only through its chaired bus identity ───
+#
+# Claude by default, with its engine keys and its yolo flag. But a window can
+# run a supported agent CLI instead — `runs.dbt: codex` on the card. Claude uses
+# its persistent stream-json process; Codex, OpenCode and Kimi use their native
+# gateways. None receives assignments through tmux. An unknown CLI must be
+# prefixed with `terminal:` to opt into the visibly labelled compatibility path.
+i=0
+for path in ${RUTAS[@]+"${RUTAS[@]}"}; do
+  win="${NOMBRES[$i]}"
+  i=$((i + 1))
+  # Professional specialty is separate from bus authority. Every repo actor is
+  # still a member; only `seat` is chair. A malformed or legacy value resolves
+  # to the explicit blank role in read-card.py.
+  ROL_REPO="$(python3 "$LEER" --actor-role "$FICHA" "$win")"
+  # This window's cage and, when the broker runs, its own single-repo token.
+  # The token travels as a file path, never on the command line, and the cage
+  # profile re-allows reading exactly that file and nothing else in the broker.
+  TOKEN_FILE=""
+  BROKER_ENV=""
+  if [ -n "$BROKER_URL" ]; then
+    TOKEN_FILE="$(python3 "$BROKERPY" mint --data "$EQUIPO" "$win" --repo "$path" --file-only 2>/dev/null || true)"
+    [ -n "$TOKEN_FILE" ] && BROKER_ENV="CITY_BROKER_URL=$BROKER_URL CITY_BROKER_TOKEN_FILE=$TOKEN_FILE "
+  fi
+  MOUNTS_WIN="${MONTAJES[$((i - 1))]:-}"
+  JAULA="$(jaula_de "$win" "$path" "$TOKEN_FILE" "$MOUNTS_WIN")"
+  CAGE_RUNTIME_ENV=""
+  [ -n "$JAULA" ] && CAGE_RUNTIME_ENV="env CITY_OUTER_CAGE=1 "
+  tmux new-window -t "$SESSION" -n "$win" -c "$path"
+  if [ "$RUN_CLAUDE" -eq 1 ]; then
+    OTRO="$(python3 "$LEER" "$FICHA" "runs.$win")"
+    if [ -n "$OTRO" ]; then
+      KIND="$(runtime_de "$OTRO")"
+      if [ "$KIND" = claude ]; then
+        espera="$(retraso "$turno")"
+        turno=$((turno + 1))
+        if [ "$espera" = "0" ]; then espera=''; else espera="sleep $espera; "; fi
+        CLAUDE_REPO="$OTRO --name $SESSION-$win --settings '$SETTINGS'$NO_PEER_TOOLS$YOLO_FLAG"
+        lanza "$SESSION:$win" "$win" "$path" \
+          "$espera$(sync_line)AGENTS_CITY_DATA=$EQUIPO AGENTS_CITY_HOME=${AGENTS_CITY_HOME:-$HOME/.agents-city} AGENTS_CITY_USER=$USUARIO CITY_ADDRESS=$ADDRESS CITY_SEAT_NAME=$SEAT_NAME CITY_BUS_ACTOR=$win CITY_AGENT_ROLE=$ROL_REPO CITY_RUNTIME_KIND=repo CITY_BUS_URL= CITY_BUS_TOKEN= $BROKER_ENV$JAULA$CAGE_RUNTIME_ENV${CLAUDE_AUTH_PREFIX}$(gateway_line "$win" "$path" "$CLAUDE_REPO")"
+      elif [ "$KIND" = codex ] || [ "$KIND" = opencode ] || [ "$KIND" = kimi ]; then
+        # Native servers have their own credentials and do not share Claude's OAuth race.
+        # Codex stays outside the outer cage ON macOS ONLY: its node_repl MCP
+        # applies its own sandbox and the macOS kernel rejects that nested
+        # sandbox_apply. That is a seatbelt constraint, not a fact about Codex —
+        # bubblewrap nests fine, and an unconditional exemption meant a Codex
+        # window on Linux could read ~/.ssh outright while every other window in
+        # the same city had it sealed. Codex's app-server still receives
+        # workspace-write below, which bounds writes but never reads.
+        RUNTIME_CAGE="$JAULA"
+        RUNTIME_CAGE_ENV="$CAGE_RUNTIME_ENV"
+        if [ "$KIND" = codex ] && [ "$(uname -s)" = "Darwin" ]; then
+          RUNTIME_CAGE=""
+          RUNTIME_CAGE_ENV=""
+        fi
+        lanza "$SESSION:$win" "$win" "$path" \
+          "$(sync_line)AGENTS_CITY_DATA=$EQUIPO AGENTS_CITY_HOME=${AGENTS_CITY_HOME:-$HOME/.agents-city} AGENTS_CITY_USER=$USUARIO CITY_ADDRESS=$ADDRESS CITY_SEAT_NAME=$SEAT_NAME CITY_BUS_ACTOR=$win CITY_AGENT_ROLE=$ROL_REPO CITY_RUNTIME_KIND=repo CITY_BUS_URL= CITY_BUS_TOKEN= $BROKER_ENV$RUNTIME_CAGE$RUNTIME_CAGE_ENV$(gateway_line "$win" "$path" "$OTRO")"
+      elif [ "$KIND" = terminal ]; then
+        FALLBACK_COMMAND="${OTRO#terminal:}"
+        lanza "$SESSION:$win" "$win" "$path" \
+          "$(sync_line)AGENTS_CITY_DATA=$EQUIPO AGENTS_CITY_HOME=${AGENTS_CITY_HOME:-$HOME/.agents-city} AGENTS_CITY_USER=$USUARIO CITY_ADDRESS=$ADDRESS CITY_SEAT_NAME=$SEAT_NAME CITY_BUS_ACTOR=$win CITY_AGENT_ROLE=$ROL_REPO CITY_RUNTIME_KIND=repo CITY_BUS_URL= CITY_BUS_TOKEN= $BROKER_ENV$JAULA$FALLBACK_COMMAND"
+        "$RUNTIME" fallback "$win" "$SESSION:$win" "${FALLBACK_COMMAND%% *}"
+      else
+        tmux send-keys -t "$SESSION:$win" \
+          "echo 'No native Agents City gateway for: $OTRO. Use terminal:$OTRO only if you explicitly accept terminal injection.'" C-m
+      fi
+    else
+      espera="$(retraso "$turno")"
+      turno=$((turno + 1))
+      if [ "$espera" = "0" ]; then espera=''; else espera="sleep $espera; "; fi
+      CLAUDE_REPO="claude --name $SESSION-$win$(motor_de "$win") --settings '$SETTINGS'$NO_PEER_TOOLS$YOLO_FLAG"
+      lanza "$SESSION:$win" "$win" "$path" \
+        "$espera$(sync_line)AGENTS_CITY_DATA=$EQUIPO AGENTS_CITY_HOME=${AGENTS_CITY_HOME:-$HOME/.agents-city} AGENTS_CITY_USER=$USUARIO CITY_ADDRESS=$ADDRESS CITY_SEAT_NAME=$SEAT_NAME CITY_BUS_ACTOR=$win CITY_AGENT_ROLE=$ROL_REPO CITY_RUNTIME_KIND=repo CITY_BUS_URL= CITY_BUS_TOKEN= $BROKER_ENV${JAULA}$CAGE_RUNTIME_ENV${CLAUDE_AUTH_PREFIX}$(gateway_line "$win" "$path" "$CLAUDE_REPO")"
+    fi
+  fi
+done
+
+if [ ${#faltan[@]-0} -gt 0 ]; then
+  echo >&2
+  echo "I could not find these repos on this machine (window skipped):" >&2
+  printf '  %s\n' "${faltan[@]}" >&2
+  echo >&2
+  echo "If they live somewhere unusual:  CITY_SEARCH_IN=/where/they/are $(basename "$0")" >&2
+  echo "If you simply do not have them, clone them anywhere and run this again." >&2
+fi
+
+if [ "${#RUTAS[@]}" -eq 0 ]; then
+  # Not "yet". A role that owns no folders is a real answer, not an unfinished
+  # setup: the architect, the surveyor and the land surveyor own a property of
+  # everybody else's folders and none of their own. What they are for begins when
+  # there are other cities to reach. Keyed on the windows actually opened, so an
+  # agent-first card with agents but no `repos:` field does not trip it.
+  echo "You own no folders, so this is the seat window on its own — which is what" >&2
+  echo "a $AGENTE day looks like. Your role's work starts when there are other" >&2
+  echo "cities to reach: that is the bus." >&2
+  echo >&2
+  echo "If that is wrong and you do own folders:  ./bin/seat --repos" >&2
+fi
+
+tmux select-window -t "$SESSION:seat"
+exec tmux attach -d -t "$SESSION"

package/plugin/scripts/city_env.py

@@ -0,0 +1,67 @@
+#!/usr/bin/env python3
+"""Where a seat's settings come from, for the Python side of the plugin.
+
+The shell has scripts/city-env.sh; this is the same order for the same keys, so
+there is one answer to "which city, which token, which data" and not one per
+script. Both reporters used to carry their own copy, and a copy is a thing that
+drifts.
+
+Order: the environment wins — that is how the MCP server passes user config —
+then the .env the setup writes, then the OS keychain for the token alone.
+"""
+import os
+import subprocess
+
+import cities
+
+CANAL = os.environ.get('CITY_DIR', os.path.expanduser('~/.claude/channels/city-bus'))
+LLAVERO = 'city@agents-city'
+
+
+def fichero():
+    """The keys in ~/.claude/channels/city-bus/.env, or an empty dict."""
+    d = {}
+    try:
+        with open(os.path.join(CANAL, '.env')) as f:
+            for linea in f:
+                if '=' in linea and not linea.strip().startswith('#'):
+                    k, v = linea.split('=', 1)
+                    d[k.strip()] = v.strip().strip('"').strip("'")
+    except OSError:
+        pass
+    return d
+
+
+def ajuste(clave, defecto=''):
+    return os.environ.get(clave) or fichero().get(clave) or defecto
+
+
+def url():
+    """The city's URL. Falls back to the bus's, because unless somebody split
+    them they are the same Worker."""
+    return ajuste('AGENTS_CITY_URL') or ajuste('CITY_BUS_URL')
+
+
+def datos():
+    """The selected personal city; an explicit external folder still wins."""
+    puesto = ajuste('AGENTS_CITY_DATA')
+    if puesto and os.path.isdir(os.path.expanduser(puesto)):
+        return os.path.expanduser(puesto)
+    return cities.actual(os.environ.get('AGENTS_CITY_USER') or cities.usuario_actual())
+
+
+def token(dado=''):
+    """The bus token: given, from the environment, from .env, or the keychain."""
+    if dado:
+        return dado
+    v = ajuste('CITY_BUS_TOKEN')
+    if v:
+        return v
+    try:
+        r = subprocess.run(['security', 'find-generic-password', '-s', LLAVERO, '-w'],
+                           capture_output=True, text=True)
+        if r.returncode == 0:
+            return r.stdout.strip()
+    except (OSError, FileNotFoundError):
+        pass
+    return ''