agents-city 0.3.0-beta.21 → 0.3.0

package/plugin/scripts/cage.py

@@ -1,5 +1,9 @@
 #!/usr/bin/env python3
-"""The cage: one macOS seatbelt profile per repo window.
+"""The cage: one kernel-enforced confinement per agent window.
+
+macOS gets a generated seatbelt profile; Linux gets a bubblewrap mount
+namespace. Two mechanisms, one meaning — and the meaning is what this module
+owns, so the launcher asks for a prefix and never learns which kernel it is on.
 
 The yolo flag stays — a committee cannot work if every bus command needs a
 human. What changes is what the kernel lets the window touch. An agent inside
@@ -22,9 +26,12 @@ compromised window can steal — it is not hostile-process isolation.
 """
 
 import argparse
+import functools
 import os
 import re
+import shlex
 import shutil
+import subprocess
 import sys
 
 import rutas
@@ -40,7 +47,15 @@ SECRETOS_DIR = (
 # it breaks every `npm install` for owners who configure a registry, and a
 # broken product protects nobody. Owners who keep tokens there add it through
 # CITY_CAGE_DENY.
-SECRETOS_FICHERO = ('.git-credentials', '.netrc', '.pgpass')
+SECRETOS_FICHERO = (
+    '.git-credentials', '.netrc', '.pgpass',
+    # The one this product created itself. Outside macOS there is no Keychain
+    # and Claude Code writes its OAuth access and refresh tokens here as plain
+    # JSON — inside a directory the cage keeps WRITABLE for runtime state. Every
+    # third-party credential store was sealed and ours was not, which made the
+    # cage's promise false exactly where it mattered most.
+    os.path.join('.claude', '.credentials.json'),
+)
 
 # Writable beyond the repo: the runtime state and build caches a working agent
 # legitimately owns. Everything here is cache or agent state, never a secret —
@@ -49,12 +64,44 @@ ESCRITURA_CASA = (
     '.claude', '.agents-city', '.codex', '.opencode', '.kimi',
     '.npm', '.cache', '.cargo', '.rustup', '.gradle', '.m2',
     '.pnpm-store', '.bun',
+)
+#: Where each kernel keeps the rest of that state. Splitting the system paths
+#: and leaving these shared was an oversight with teeth: `Library/pnpm` is
+#: pnpm's macOS home and its Linux twin `~/.local/share/pnpm` was missing, so a
+#: caged `pnpm add -g`, `pip install --user`, `pipx` or `go install` all failed
+#: with a read-only filesystem for reasons nobody would connect to the cage.
+ESCRITURA_CASA_MAC = (
     os.path.join('Library', 'Caches'),
     os.path.join('Library', 'Logs'),
     os.path.join('Library', 'pnpm'),
     os.path.join('Library', 'Developer'),
 )
+ESCRITURA_CASA_LINUX = (
+    os.path.join('.local', 'share'),
+    os.path.join('.local', 'state'),
+    os.path.join('.local', 'bin'),
+    '.config',
+    'go',
+)
+#: Temporary and device paths a working agent legitimately writes, per kernel.
+#: Keyed by platform because "where /tmp really is" is the one fact the two
+#: cages genuinely disagree on — everything else below is shared.
 ESCRITURA_SISTEMA = ('/dev', '/private/tmp', '/private/var/tmp', '/private/var/folders')
+#: `/dev` is deliberately absent: the argv already gives the sandbox its own
+#: device tree, and re-binding the host's over it would undo that.
+ESCRITURA_SISTEMA_LINUX = ('/tmp', '/var/tmp', '/run/user')
+
+
+def escritura_sistema():
+    """The temp and device paths of the kernel we are RUNNING on.
+
+    Only for callers that have no cage of their own to name. Each renderer
+    passes its own tuple instead: the bubblewrap argv is the Linux cage
+    wherever it is built, so a macOS machine writing one — a test, a review —
+    must still produce Linux paths, or the thing under test is not the thing
+    that ships.
+    """
+    return ESCRITURA_SISTEMA_LINUX if sys.platform.startswith('linux') else ESCRITURA_SISTEMA
 
 
 def _sbpl(ruta):
@@ -73,6 +120,34 @@ def agents_home(casa):
     return rutas.canonicaliza(hogar)
 
 
+def sellados_por_tipo(casa):
+    """The sealed roots, each with what it IS: a file or a directory.
+
+    Decided by DECLARATION first and by the disk second. It matters because the
+    two cages render the two kinds differently — a directory becomes an empty
+    tmpfs, a file becomes /dev/null — and a credential file that does not exist
+    yet must still be sealed as a file, or the cage mounts a directory in its
+    place and the runtime can never create it.
+    """
+    ac = agents_home(casa)
+    fuera = {}
+    for d in SECRETOS_DIR:
+        fuera[rutas.canonicaliza(os.path.join(casa, d))] = 'dir'
+    for f in SECRETOS_FICHERO:
+        fuera[rutas.canonicaliza(os.path.join(casa, f))] = 'file'
+    fuera[rutas.canonicaliza(os.path.join(ac, '.runtime', 'broker'))] = 'dir'
+    for f in ('credentials', 'credentials.toml'):
+        fuera[rutas.canonicaliza(os.path.join(casa, '.cargo', f))] = 'file'
+    # An owner's own denies: nothing declares their kind, so ask the disk and
+    # treat anything else as a directory, which seals more rather than less.
+    for p in os.environ.get('CITY_CAGE_DENY', '').split(':'):
+        if not p:
+            continue
+        real = rutas.canonicaliza(os.path.expanduser(p))
+        fuera[real] = 'file' if os.path.isfile(real) else 'dir'
+    return fuera
+
+
 def sellados(casa):
     """The canonical set of read+write-sealed roots.
 
@@ -81,18 +156,10 @@ def sellados(casa):
     it. Extra owner denies (CITY_CAGE_DENY) join it, so an owner can widen the
     seal but the allow-list can never outrun it.
     """
-    ac = agents_home(casa)
-    extra = [p for p in os.environ.get('CITY_CAGE_DENY', '').split(':') if p]
-    raices = [os.path.join(casa, d) for d in SECRETOS_DIR]
-    raices += [os.path.join(casa, f) for f in SECRETOS_FICHERO]
-    raices += [os.path.expanduser(p) for p in extra]
-    raices.append(os.path.join(ac, '.runtime', 'broker'))
-    raices.append(os.path.join(casa, '.cargo', 'credentials'))
-    raices.append(os.path.join(casa, '.cargo', 'credentials.toml'))
-    return [rutas.canonicaliza(r) for r in raices]
+    return list(sellados_por_tipo(casa))
 
 
-def _permitidas_escritura(repo, casa, bloqueados, extra_escritura=()):
+def _permitidas_escritura(repo, casa, bloqueados, extra_escritura=(), sistema=None):
     """Canonical write-allow roots, given the already-computed sealed set.
 
     Covering roots are intentionally kept: the sealed-secret block is emitted
@@ -111,8 +178,12 @@ def _permitidas_escritura(repo, casa, bloqueados, extra_escritura=()):
     extra = [os.path.expanduser(p)
              for p in os.environ.get('CITY_CAGE_ALLOW_WRITE', '').split(':') if p]
     extra += list(extra_escritura)
-    fijas = [repo, agents_home(casa), *ESCRITURA_SISTEMA]
+    linux = sistema is ESCRITURA_SISTEMA_LINUX or (
+        sistema is None and sys.platform.startswith('linux'))
+    fijas = [repo, agents_home(casa), *(sistema if sistema is not None else escritura_sistema())]
     fijas += [os.path.join(casa, p) for p in ESCRITURA_CASA]
+    fijas += [os.path.join(casa, p)
+              for p in (ESCRITURA_CASA_LINUX if linux else ESCRITURA_CASA_MAC)]
     aceptadas = [rutas.canonicaliza(c) for c in fijas]
     for c in extra:
         if any(rutas.dentro_de(c, raiz) for raiz in bloqueados):
@@ -123,25 +194,54 @@ def _permitidas_escritura(repo, casa, bloqueados, extra_escritura=()):
 
 
 def _lineas_permite_escritura(repo, casa, bloqueados, extra_escritura=()):
-    permitidas = _permitidas_escritura(repo, casa, bloqueados, extra_escritura)
+    permitidas = _permitidas_escritura(repo, casa, bloqueados, extra_escritura,
+                                      sistema=ESCRITURA_SISTEMA)
     lineas = [f'  (subpath {_sbpl(r)})' for r in permitidas]
     # Claude keeps `~/.claude.json` (and its backups) at the HOME root.
     lineas.append(f'  (regex #"^{re.escape(os.path.join(casa, ".claude.json"))}")')
     return lineas
 
 
+def carreteras_raiz(casa):
+    """Where a seat's remote-road channels live. One spelling, two readers."""
+    return os.path.join(casa, '.claude', 'channels')
+
+
+def env_de_carreteras(casa):
+    """The remote-road token files: `~/.claude/channels/<seat>/.env`.
+
+    One definition of "these are secrets too", because the two cages render it
+    differently — macOS as a regex over a path that may not exist yet, Linux as
+    one mount per file that does. A rule written twice is a rule that will be
+    sealed on one kernel and open on the other.
+    """
+    canales = carreteras_raiz(casa)
+    try:
+        entradas = sorted(os.listdir(canales))
+    except OSError:
+        return []
+    fuera = []
+    for entrada in entradas:
+        env = os.path.join(canales, entrada, '.env')
+        if os.path.isfile(env):
+            fuera.append(env)
+    return fuera
+
+
 def _lineas_secretos(casa, bloqueados):
+    tipos = sellados_por_tipo(casa)
     lineas = []
     for raiz in bloqueados:
-        # A file target uses `literal`; a directory (or a not-yet-created dir)
-        # uses `subpath` so everything beneath it is sealed too.
-        if os.path.isfile(raiz):
+        # A file target uses `literal`; a directory uses `subpath` so everything
+        # beneath it is sealed too. The kind comes from the declaration, so a
+        # credential file that does not exist yet is still sealed as a file.
+        if tipos.get(raiz, 'dir') == 'file':
             lineas.append(f'  (literal {_sbpl(raiz)})')
         else:
             lineas.append(f'  (subpath {_sbpl(raiz)})')
     # Remote road tokens configured for the seat: repo windows must never read
     # them, even though the rest of `~/.claude` stays open for the runtime.
-    canal = re.escape(os.path.join(casa, '.claude', 'channels'))
+    canal = re.escape(carreteras_raiz(casa))
     lineas.append(f'  (regex #"^{canal}/[^/]+/\\.env$")')
     return lineas
 
@@ -181,11 +281,146 @@ def perfil(repo, casa=None, fichero_token=None, extra_escritura=()):
     return '\n'.join(partes) + '\n'
 
 
+# ── Linux: the same seal, built out of mounts instead of a profile ───────────
+#
+# Bubblewrap applies its binds in order and the last one wins, so the argv obeys
+# the same ordering guarantee the profile above states — and a sealed path is
+# not refused here, it is simply not mounted.
+
+#: The base every caged launch starts from — and the exact same flags the
+#: availability probe runs, so "bwrap works here" cannot mean a different
+#: sandbox than the one an agent gets.
+BASE_BWRAP = ['bwrap', '--ro-bind', '/', '/', '--dev', '/dev']
+
+
+@functools.lru_cache(maxsize=None)
+def _prueba_bwrap():
+    """Build one real namespace and remember whether it worked."""
+    if not shutil.which('bwrap'):
+        return False
+    try:
+        hecho = subprocess.run(
+            # It either builds a namespace in milliseconds or it is refused;
+            # nothing in between, so a long timeout only buys dead launch time.
+            [*BASE_BWRAP, 'true'],
+            capture_output=True,
+            timeout=5,
+        )
+        return hecho.returncode == 0
+    except (OSError, subprocess.SubprocessError):
+        return False
+
+
+def bwrap_sirve():
+    """Whether bubblewrap can actually build a namespace here — not merely
+    whether the binary exists.
+
+    Ubuntu 24 restricts unprivileged user namespaces through AppArmor, and a
+    hardened kernel can refuse them outright. A prefix that fails at launch
+    would take the agent's window down with it, so this asks bwrap to do the
+    real thing rather than trusting `which`.
+
+    The launcher runs this module as a fresh process PER WINDOW, so the answer
+    is also read from and published to the environment: a city of eight agents
+    forks one probe, not eight. `CITY_CAGE_BWRAP=1|0` is that channel, and an
+    owner can set it by hand to skip the probe entirely.
+    """
+    # The environment outranks the memo on purpose: it is how the launcher hands
+    # one probe's answer to every window, and how an owner skips probing at all.
+    dicho = os.environ.get('CITY_CAGE_BWRAP')
+    if dicho == '0':
+        return False
+    if dicho == '1':
+        # Trusted, but not blindly: tmux windows inherit the server's whole
+        # environment, so a value set on another machine (or a stale one) would
+        # otherwise build a prefix that exits 127 on every single window.
+        return shutil.which('bwrap') is not None
+    return _prueba_bwrap()
+
+
+def argv_bwrap(repo, casa=None, fichero_token=None, extra_escritura=()):
+    """The bubblewrap argv that cages one window on Linux. Pure: no writes.
+
+    Returns the prefix only — the caller appends the command to run.
+    """
+    casa = rutas.canonicaliza(casa or '~')
+    repo = rutas.canonicaliza(repo)
+    if not os.path.isdir(repo):
+        raise ValueError(f'the cage needs an existing working directory, got: {repo}')
+    bloqueados = sellados(casa)
+    motivo = rutas.motivo_bloqueo(repo, bloqueados)
+    if motivo:
+        raise ValueError(f'the working directory is unsafe to cage: {motivo}')
+
+    # Deliberately NOT here:
+    #   --proc      needs a PID namespace to be worth anything, and a PID
+    #               namespace would make the runtime gateway write a
+    #               namespace-local pid into <runtime>/gateways/<actor>.pid —
+    #               which `agents-city exit` then signals on the host, killing
+    #               an unrelated process. /proc arrives with the read-only bind
+    #               of / anyway.
+    #   --die-with-parent
+    #               the bus hub is started detached ON PURPOSE so it outlives
+    #               the window that happened to start it; tying the namespace's
+    #               life to one pane would take the whole city's bus down with
+    #               that pane. macOS has no equivalent flag either.
+    argv = BASE_BWRAP.copy()
+    # The working set, re-bound writable over the read-only world. The set is
+    # `_permitidas_escritura`'s answer and only that: the same list the SBPL
+    # profile allows, so the two cages cannot drift into permitting different
+    # things.
+    for ruta in _permitidas_escritura(repo, casa, bloqueados, extra_escritura,
+                                      sistema=ESCRITURA_SISTEMA_LINUX):
+        # `-try` because a build cache nobody has created yet is not an error,
+        # and a cage that refuses to start is a cage nobody keeps switched on.
+        argv += ['--bind-try', ruta, ruta]
+    # And then the seal. A directory becomes an empty tmpfs; a file becomes
+    # /dev/null, which cannot be read through.
+    #
+    # ONLY what exists is sealed, and that is not a shortcut — it is the
+    # difference between a cage and a machine that cannot start. `--tmpfs` has
+    # no `-try` form and bwrap creates the mountpoint with a single mkdir: over
+    # a read-only `/`, sealing an absent `~/.aws` aborts the launch, and where
+    # the parent IS writable it does worse — it leaves a real empty directory
+    # on the owner's disk, so a later `cargo login` fails forever with "Is a
+    # directory" and nothing points back here.
+    #
+    # Skipping an absent path costs nothing: `$HOME` itself is never writable
+    # inside the cage, so a window cannot create the secret it was not sealed
+    # from. What a seal cannot cover is a path created OUTSIDE, mid-session —
+    # the same bounded difference the road tokens have, documented in
+    # docs/security.md rather than papered over.
+    tipos = sellados_por_tipo(casa)
+    for raiz in bloqueados:
+        if not os.path.exists(raiz):
+            continue
+        if tipos.get(raiz, 'dir') == 'file':
+            argv += ['--ro-bind-try', '/dev/null', raiz]
+        else:
+            argv += ['--tmpfs', raiz]
+    # Claude keeps `~/.claude.json` at the HOME root, and the SBPL profile
+    # allows writing it. Without the same line here the Linux cage silently
+    # breaks the runtime it is meant to protect.
+    conf = rutas.canonicaliza(os.path.join(casa, '.claude.json'))
+    argv += ['--bind-try', conf, conf]
+    # Remote road tokens: the same rule the profile states as a regex, applied
+    # here one file at a time because a mount needs a path, not a pattern.
+    for env in env_de_carreteras(casa):
+        argv += ['--ro-bind-try', '/dev/null', env]
+    if fichero_token:
+        # Last word: this window's own token, and only this one.
+        real = rutas.canonicaliza(fichero_token)
+        argv += ['--ro-bind-try', real, real]
+    return argv
+
+
 def disponible():
     """Whether this machine can cage a window at all."""
     if os.environ.get('CITY_CAGE', '1') == '0':
         return False
-    return sys.platform == 'darwin' and shutil.which('sandbox-exec') is not None
+    if sys.platform == 'darwin':
+        return shutil.which('sandbox-exec') is not None
+    return sys.platform.startswith('linux') and bwrap_sirve()
 
 
 def escribe_perfil(repo, ventana, casa=None, fichero_token=None, extra_escritura=()):
@@ -204,17 +439,22 @@ def escribe_perfil(repo, ventana, casa=None, fichero_token=None, extra_escritura
 
 
 def linea(repo, ventana, casa=None, fichero_token=None, extra_escritura=()):
-    """The launch prefix for one window: `sandbox-exec -f <profile> `, or ''.
+    """The launch prefix for one window, ready to prepend to a shell command:
+    `sandbox-exec -f <profile> ` on macOS, `bwrap … ` on Linux, or ''.
 
-    Empty means "launch uncaged": not macOS, no sandbox-exec, or the owner set
-    CITY_CAGE=0. The caller prepends the result verbatim, so the degraded path
-    is exactly the behaviour the product always had.
+    Empty means "launch uncaged": an unsupported platform, no sandboxing tool,
+    or the owner set CITY_CAGE=0. The caller prepends the result verbatim, so
+    the degraded path is exactly the behaviour the product always had.
     """
     if not disponible():
         return ''
-    ruta = escribe_perfil(repo, ventana, casa=casa, fichero_token=fichero_token,
-                          extra_escritura=extra_escritura)
-    return f'sandbox-exec -f {ruta} '
+    if sys.platform == 'darwin':
+        ruta = escribe_perfil(repo, ventana, casa=casa, fichero_token=fichero_token,
+                              extra_escritura=extra_escritura)
+        return f'sandbox-exec -f {ruta} '
+    argv = argv_bwrap(repo, casa=casa, fichero_token=fichero_token,
+                      extra_escritura=extra_escritura)
+    return shlex.join(argv) + ' '
 
 
 def main():

package/plugin/scripts/capabilities.py

@@ -9,9 +9,9 @@ can see which agent is likely to know how to help.
 
 import os
 import re
-import subprocess
 import sys
 
+import busca  # the one disk scanner: repos, worktrees and document folders
 import card
 import cities
 import workspace
@@ -77,17 +77,24 @@ def descubre_repo(ruta_repo):
     return fuera
 
 
-def _indice_repos():
-    guion = os.path.join(os.path.dirname(__file__), "find-repos.sh")
+#: The disk index, remembered for a moment. `busca` keeps its own
+#: day-long cache, but SPAWNING it and re-parsing the TSV is ~15 ms, and one
+#: Hall request resolves it once per legacy agent — N+1 processes for one
+#: answer. A short memory collapses that to one while staying young enough to
+#: notice a repo cloned a minute ago.
+_INDICE = {"cuando": 0.0, "valor": None}
+
+
+def _indice_repos(vida=90):
+    import time
+
+    if _INDICE["valor"] is not None and time.monotonic() - _INDICE["cuando"] < vida:
+        return _INDICE["valor"]
     try:
-        salida = subprocess.run([guion], capture_output=True, text=True, timeout=300).stdout
-    except (OSError, subprocess.TimeoutExpired):
+        fuera = dict(busca.repos())
+    except OSError:
         return {}
-    fuera = {}
-    for linea in salida.splitlines():
-        if "\t" in linea:
-            nombre, ruta = linea.split("\t", 1)
-            fuera[nombre.strip()] = ruta.strip()
+    _INDICE["cuando"], _INDICE["valor"] = time.monotonic(), fuera
     return fuera
 
 

package/plugin/scripts/card.py

@@ -27,6 +27,16 @@ import re
 # than that something moved.
 CAMPOS = ('user', 'name', 'role', 'agent', 'repos', 'goals_defined')
 ROLE_ID = re.compile(r'^[a-z0-9][a-z0-9-]{0,63}$')
+#: What `ventana()` can produce, as a shape callers can check without rebuilding
+#: it. A window slug is longer than a role id (80 vs 64), and every door that
+#: resolves an agent by slug has to agree on that or a long-named agent renders
+#: everywhere and answers nowhere.
+VENTANA_ID = re.compile(r'^[a-z0-9][a-z0-9-]{0,79}$')
+
+
+def ventana_valida(valor):
+    """Whether this is a window slug the rest of the product will accept."""
+    return bool(VENTANA_ID.fullmatch(str(valor or '')))
 
 
 def frontmatter(texto):

package/plugin/scripts/cities.py

@@ -248,6 +248,40 @@ def crea(usuario, nombre_ciudad, usar=True):
     return _real(destino)
 
 
+def archiva(datos, usuario=''):
+    """Take one city out of use, keeping every byte of it.
+
+    Deliberately NOT a delete. A city is somebody's cards, deliberations and
+    map; a product that offers to erase that with one click will eventually
+    erase the wrong one. So the folder MOVES into `<user>/.backups/` with a
+    timestamp, the registry forgets it, and the selection falls back to another
+    city — recoverable with `mv`, which is a sentence a person can act on.
+
+    Returns the backup path. Refuses a city that is not this owner's managed
+    one, and refuses the last one standing: a city list with nothing in it is
+    not a state this product knows how to be in.
+    """
+    usuario = _slug(usuario or usuario_actual(), 'me')
+    real = _real(datos)
+    if not es_ciudad(real):
+        raise ValueError(f'{datos} is not a city')
+    if not gestionada(real, usuario):
+        raise ValueError('that city lives outside this owner\'s folder; move it by hand')
+    restantes = [c for c in lista(usuario) if _real(c['ruta']) != real]
+    if not restantes:
+        raise ValueError('this is your only city — create another one first')
+    base = os.path.join(carpeta_usuario(usuario), '.backups')
+    os.makedirs(base, mode=0o700, exist_ok=True)
+    destino, _ = _respaldo_libre(base, f'archivada-{nombre(real) or "city"}')
+    # The registry only ever held EXTERNAL cities — a managed one is found by
+    # walking the owner's folder, so moving it out is the whole removal.
+    seleccionada = _real(actual(usuario, crear=False) or '')
+    shutil.move(real, destino)
+    if seleccionada == real:
+        selecciona(usuario, restantes[0]['ruta'])
+    return destino
+
+
 def _registro_para(usuario):
     try:
         lineas = [l.strip() for l in open(REGISTRO, encoding='utf-8') if l.strip()]

package/plugin/scripts/city-session.sh

@@ -160,11 +160,34 @@ CLAUDE_AUTH_PREFIX=""
 CAGE="$(dirname "$0")/cage.py"
 BROKERPY="$(dirname "$0")/broker.py"
 WORKSPACE="$(dirname "$0")/workspace.py"
+# On Linux the cage is a bubblewrap namespace, and deciding whether the kernel
+# will grant one means actually building one. `cage.py` runs as a fresh process
+# per window, so without this the probe is paid once per agent instead of once
+# per city — and on a kernel that refuses namespaces, paid slowly. Ask once,
+# hand the answer to every window.
+if [ -z "${CITY_CAGE_BWRAP:-}" ] && [ "$(uname -s)" = "Linux" ]; then
+  if python3 "$CAGE" check >/dev/null 2>&1; then
+    CITY_CAGE_BWRAP=1
+  else
+    CITY_CAGE_BWRAP=0
+  fi
+  export CITY_CAGE_BWRAP
+fi
+
 jaula_de() {  # window, cwd, [broker token file], [colon-joined mount targets] -> prefix or ''
-  local args=(line --window "$1" --repo "$2")
+  local args=(line --window "$1" --repo "$2") salida estado
   [ -n "${3:-}" ] && args+=(--token-file "$3")
   [ -n "${4:-}" ] && args+=(--mounts "$4")
-  python3 "$CAGE" "${args[@]}" 2>/dev/null || true
+  salida="$(python3 "$CAGE" "${args[@]}" 2>&1)"; estado=$?
+  # An empty prefix is a normal answer: no cage on this machine, or CITY_CAGE=0.
+  # A FAILURE is not — a working directory that covers a sealed root is refused
+  # on purpose, and swallowing that refusal launched the window uncaged and
+  # silent, which is the one outcome nobody would notice.
+  if [ $estado -ne 0 ]; then
+    printf '  %s launches WITHOUT a cage: %s\n' "$1" "$salida" >&2
+    return 0
+  fi
+  printf '%s' "$salida"
 }
 
 # Which model and effort a window's agent starts with. Three voices, in order:
@@ -468,13 +491,16 @@ for path in ${RUTAS[@]+"${RUTAS[@]}"}; do
           "$espera$(sync_line)AGENTS_CITY_DATA=$EQUIPO AGENTS_CITY_HOME=${AGENTS_CITY_HOME:-$HOME/.agents-city} AGENTS_CITY_USER=$USUARIO CITY_ADDRESS=$ADDRESS CITY_SEAT_NAME=$SEAT_NAME CITY_BUS_ACTOR=$win CITY_AGENT_ROLE=$ROL_REPO CITY_RUNTIME_KIND=repo CITY_BUS_URL= CITY_BUS_TOKEN= $BROKER_ENV$JAULA$CAGE_RUNTIME_ENV${CLAUDE_AUTH_PREFIX}$(gateway_line "$win" "$path" "$CLAUDE_REPO")"
       elif [ "$KIND" = codex ] || [ "$KIND" = opencode ] || [ "$KIND" = kimi ]; then
         # Native servers have their own credentials and do not share Claude's OAuth race.
-        # Codex must remain outside the outer macOS seatbelt: its node_repl MCP
-        # applies its own sandbox and macOS rejects that nested sandbox_apply.
-        # Codex's app-server receives workspace-write below; OpenCode and Kimi
-        # still use the per-repo outer cage.
+        # Codex stays outside the outer cage ON macOS ONLY: its node_repl MCP
+        # applies its own sandbox and the macOS kernel rejects that nested
+        # sandbox_apply. That is a seatbelt constraint, not a fact about Codex —
+        # bubblewrap nests fine, and an unconditional exemption meant a Codex
+        # window on Linux could read ~/.ssh outright while every other window in
+        # the same city had it sealed. Codex's app-server still receives
+        # workspace-write below, which bounds writes but never reads.
         RUNTIME_CAGE="$JAULA"
         RUNTIME_CAGE_ENV="$CAGE_RUNTIME_ENV"
-        if [ "$KIND" = codex ]; then
+        if [ "$KIND" = codex ] && [ "$(uname -s)" = "Darwin" ]; then
           RUNTIME_CAGE=""
           RUNTIME_CAGE_ENV=""
         fi