agents-city 0.4.0 → 0.5.1

package/bin/serve.py

@@ -23,7 +23,9 @@ import re
 import secrets
 import shutil
 import signal
+import sqlite3
 import socketserver
+import stat
 import subprocess
 import sys
 import threading
@@ -40,9 +42,11 @@ import domains  # noqa: E402
 import gh  # noqa: E402
 import parcels  # noqa: E402
 import units  # noqa: E402
+import busca  # noqa: E402  the disk scanner, and the one list of where work lives
 import cities  # noqa: E402
 import demos  # noqa: E402  the recorded demos the Hall plays back
 import roads  # noqa: E402
+import reception  # noqa: E402
 import capabilities  # noqa: E402
 import deliberations  # noqa: E402
 import avatar  # noqa: E402
@@ -187,6 +191,22 @@ def estado_seguro_agentes(datos):
         return []
 
 
+def resumen_recepcion_segura():
+    """A damaged optional inbox must not make the whole local Hall disappear."""
+    try:
+        return reception.resumen()
+    except (OSError, sqlite3.Error, reception.ReceptionError) as e:
+        return {
+            "pending": 0,
+            "pendingBytes": 0,
+            "routingMode": "manual",
+            "reviewPolicy": "every_message",
+            "routerProfile": None,
+            "autoAvailable": False,
+            "error": str(e),
+        }
+
+
 def olvida_skills():
     """Forget the discovery memo: a skill was installed or removed, and that
     changes the answer without touching the card."""
@@ -401,24 +421,6 @@ def historia_del_demo(datos):
     historia = lee_clave(os.path.join(datos, "city.yml"), "domain")
     return historia if historia in DEMO_STORIES else "software"
 
-# Where people actually keep their code. The curses wizard offered `~/code` and
-# nothing else, which is wrong on most machines and silently scans a folder that
-# is not there. Offer the ones that exist, most-repos first, and let them type.
-CANDIDATAS = [
-    "code",
-    "codigo",
-    "src",
-    "dev",
-    "devel",
-    "projects",
-    "proyectos",
-    "work",
-    "trabajo",
-    "repos",
-    "git",
-    "Developer",
-    "Documents",
-]
 
 
 def glob_fichas(datos):
@@ -524,30 +526,16 @@ def actividad_viva(datos):
 def _que_es_git(ruta):
     """`repo`, `worktree`, or nothing. A label on a row, never a filter: the
     picker shows every folder and lets the person decide which one matters."""
-    marca = os.path.join(ruta, ".git")
-    if os.path.isdir(marca):
-        return "repo"
-    if os.path.isfile(marca):
-        return "worktree"
-    return ""
+    try:
+        # One stat, not an isdir followed by an isfile: a clone's `.git` is a
+        # directory and a linked worktree's is a file, and that is the whole
+        # question.
+        modo = os.stat(os.path.join(ruta, ".git")).st_mode
+    except OSError:
+        return ""
+    return "repo" if stat.S_ISDIR(modo) else "worktree"
 
 
-def carpetas_probables():
-    """Existing folders under $HOME that look like where the work lives."""
-    casa = os.path.expanduser("~")
-    fuera = []
-    for n in CANDIDATAS:
-        ruta = os.path.join(casa, n)
-        if not os.path.isdir(ruta):
-            continue
-        try:
-            hijos = [x for x in os.listdir(ruta) if not x.startswith(".")]
-            gits = sum(1 for x in hijos if os.path.isdir(os.path.join(ruta, x, ".git")))
-        except OSError:
-            continue
-        fuera.append({"ruta": ruta, "nombre": n, "items": len(hijos), "gits": gits})
-    fuera.sort(key=lambda c: (-c["gits"], -c["items"]))
-    return fuera
 
 
 def catalogo_roles(dominio):
@@ -705,6 +693,7 @@ class Manejador(http.server.BaseHTTPRequestHandler):
         "/api/demos": "g_demos",
         "/api/domains": "g_domains",
         "/api/roles": "g_roles",
+        "/api/reception": "g_reception",
     }
     POSTS = {
         "/api/ficha": "p_ficha",
@@ -716,6 +705,7 @@ class Manejador(http.server.BaseHTTPRequestHandler):
         "/api/ciudad-archiva": "p_archiva_ciudad",
         "/api/ciudad-reinicia": "p_reinicia_ciudad",
         "/api/roads": "p_roads",
+        "/api/reception": "p_reception",
         "/api/agente": "p_agente",
         "/api/agentes": "p_agentes",
         "/api/montaje": "p_montaje",
@@ -837,6 +827,7 @@ class Manejador(http.server.BaseHTTPRequestHandler):
                 # Registration is earned by writing to one, never by looking.
                 "ciudades": lista_con(datos),
                 "roads": roads.lee(datos),
+                "reception": resumen_recepcion_segura(),
                 "invitation": roads.invitacion(datos, owner),
                 "skills": habilidades,
                 "deliberations": deliberations.lista(datos),
@@ -855,6 +846,13 @@ class Manejador(http.server.BaseHTTPRequestHandler):
     def g_live(self, q):
         return self.responde(actividad_viva(self.ciudad(q)))
 
+    def g_reception(self, q):
+        """Owner-level remote quarantine; it is deliberately not city-scoped."""
+        try:
+            return self.responde(reception.estado(seat.quien_soy(), actual=self.ciudad(q)))
+        except (OSError, sqlite3.Error, reception.ReceptionError) as e:
+            return self.responde({"error": str(e)}, codigo=503)
+
     def g_demos(self, q):
         """The recorded demos, and one of them in full when asked by name.
 
@@ -864,18 +862,14 @@ class Manejador(http.server.BaseHTTPRequestHandler):
         the browser owning a second, drifting copy of the state machine.
         """
         cual = q.get("story", [""])[0]
-        catalogo = demos.catalogo()
         if not cual:
-            return self.responde({"demos": catalogo})
-        historia = next((d for d in catalogo if d["id"] == cual), None)
-        if not historia:
-            return self.responde({"error": "no such demo"}, codigo=404)
+            return self.responde({"demos": demos.catalogo()})
+        # One read of one file: the card is derived from the very events being
+        # served, rather than building the whole shelf to look one row up.
         eventos = demos.eventos(cual)
         if not eventos:
-            return self.responde(
-                {"error": "that demo has no recording; run demo/graba.py"}, codigo=409
-            )
-        return self.responde({**historia, "eventos": eventos})
+            return self.responde({"error": "no such demo"}, codigo=404)
+        return self.responde({**(demos.ficha(cual, eventos) or {}), "eventos": eventos})
 
     def g_carpeta(self, q):
         """One folder, listed: what is in it, and what each thing is.
@@ -911,10 +905,6 @@ class Manejador(http.server.BaseHTTPRequestHandler):
                             "nombre": e.name,
                             "ruta": os.path.join(ruta, e.name),
                             "dir": es_dir,
-                            # What kind of place this is, said plainly rather
-                            # than used to filter anything out: a folder is
-                            # yours to pick whether or not it holds a .git.
-                            "git": _que_es_git(os.path.join(ruta, e.name)) if es_dir else "",
                             "enlace": e.is_symlink(),
                         }
                     )
@@ -923,40 +913,31 @@ class Manejador(http.server.BaseHTTPRequestHandler):
         # Folders first, then files, each alphabetical and case-insensitive —
         # the order every file picker has used for forty years.
         entradas.sort(key=lambda x: (not x["dir"], x["nombre"].lower()))
+        recortada = len(entradas) > 2000
+        entradas = entradas[:2000]
+        # Only now, and only for the rows that will be sent. Asking every entry
+        # in a twenty-thousand-item directory whether it holds a `.git` was
+        # eighteen thousand pairs of stat calls for rows nobody would see. What
+        # kind of place this is gets said plainly rather than used to filter
+        # anything out: a folder is yours to pick whether or not it holds one.
+        for e in entradas:
+            e["git"] = _que_es_git(e["ruta"]) if e["dir"] else ""
         casa = os.path.expanduser("~")
         arriba = os.path.dirname(ruta)
         return self.responde(
             {
                 "ruta": ruta,
                 "arriba": arriba if arriba != ruta else "",
-                "casa": casa,
                 "atajos": [
                     {"nombre": os.path.basename(c) or c, "ruta": c}
-                    for c in [casa] + [os.path.join(casa, n) for n in CANDIDATAS]
+                    for c in [casa] + [os.path.join(casa, n) for n in busca.CANDIDATAS]
                     if os.path.isdir(c)
                 ],
-                "entradas": entradas[:2000],
-                "recortada": len(entradas) > 2000,
+                "entradas": entradas,
+                "recortada": recortada,
             }
         )
 
-    def g_arranque(self, q):
-        plants = W.plantillas()
-        return self.responde(
-            {
-                "kinds": plants,
-                "destino": DESTINO,
-                "casa": os.path.expanduser("~"),
-                "carpetas": carpetas_probables(),
-                # Only whether the CLI is there. Whether it is logged in is the
-                # orgs endpoint's answer, and asking it here would make every
-                # page load wait on a network call.
-                "gh": bool(shutil.which("gh")),
-                "existe": os.path.isdir(DESTINO),
-                "paleta": [{"hex": c, "nombre": n} for c, n in W.PALETA],
-                "arquitectos": sorted(ARQUITECTOS),
-            }
-        )
 
     def g_roles(self, q):
         if q.get("scope", [""])[0] == "agent":
@@ -974,29 +955,7 @@ class Manejador(http.server.BaseHTTPRequestHandler):
             }
         )
 
-    def g_orgs(self, q):
-        return self.responde({"orgs": W.orgs_de_gh()})
 
-    def g_repos(self, q):
-        org = q.get("org", [""])[0]
-        if org:
-            hallados = [
-                {"nombre": n, "detalle": d, "fecha": f, "ruta": ""}
-                for n, d, f in W.repos_de_org(org)
-            ]
-            return self.responde({"repos": hallados})
-        base = os.path.expanduser(q.get("ruta", [""])[0])
-        if not base or not os.path.isdir(base):
-            return self.responde({"repos": [], "error": f"{base or '(empty)'} is not a folder"})
-        # Two different third columns, and saying so beats guessing in the page:
-        # a git repo reports its last commit, any-folder reports what is inside.
-        if q.get("modo", ["git"])[0] == "git":
-            crudo = W.repos_del_disco(base)
-            repos = [{"nombre": n, "ruta": r, "detalle": "", "fecha": f} for n, r, f in crudo]
-        else:
-            crudo = W.carpetas_del_disco(base)
-            repos = [{"nombre": n, "ruta": r, "detalle": d, "fecha": ""} for n, r, d in crudo]
-        return self.responde({"repos": repos})
 
     def g_gente(self, q):
         org = q.get("org", [""])[0]
@@ -1242,6 +1201,51 @@ class Manejador(http.server.BaseHTTPRequestHandler):
             return self.responde({"error": str(e)}, codigo=400)
         return self.responde({"ok": True, "roads": roads.lee(origen)})
 
+    def p_reception(self, q, cuerpo):
+        """One human decision, committed before any city can consume the text."""
+        if cuerpo.get("action") == "configure":
+            try:
+                return self.responde(
+                    reception.configura(
+                        seat.quien_soy(),
+                        cuerpo.get("routing_mode"),
+                        cuerpo.get("rules"),
+                        self.ciudad(q),
+                    )
+                )
+            except reception.ReceptionError as e:
+                return self.responde({"error": str(e)}, codigo=400)
+            except (OSError, sqlite3.Error) as e:
+                return self.responde({"error": f"reception unavailable: {e}"}, codigo=503)
+        if cuerpo.get("action") == "send":
+            try:
+                return self.responde(
+                    reception.envia(cuerpo.get("connection_id"), cuerpo.get("text")),
+                    codigo=202,
+                )
+            except reception.ReceptionError as e:
+                return self.responde({"error": str(e)}, codigo=400)
+            except (OSError, sqlite3.Error) as e:
+                return self.responde({"error": f"reception unavailable: {e}"}, codigo=503)
+        destinos = cuerpo.get("destinations") or []
+        if not isinstance(destinos, list):
+            return self.responde({"error": "destinations must be a list"}, codigo=400)
+        try:
+            resultado = reception.decide(
+                seat.quien_soy(),
+                cuerpo.get("message_id"),
+                cuerpo.get("action"),
+                destinos,
+                cuerpo.get("reason"),
+                self.ciudad(q),
+            )
+        except reception.ReceptionError as e:
+            codigo = 409 if "already" in str(e) or "conflict" in str(e) else 400
+            return self.responde({"error": str(e)}, codigo=codigo)
+        except (OSError, sqlite3.Error) as e:
+            return self.responde({"error": f"reception unavailable: {e}"}, codigo=503)
+        return self.responde(resultado)
+
     def p_mapa(self, q, cuerpo):
         # Bake and serve the map, detached. First run builds the front end and
         # seeds the local D1, so the page polls /api/estado until it is up.
@@ -1290,7 +1294,12 @@ class Manejador(http.server.BaseHTTPRequestHandler):
     # nothing, never a shell fragment". `runtime` maps to `runs.` — the launcher's
     # own key — and the web deliberately cannot reach the terminal: fallback.
     CAMPOS_DE_AGENTE = {
-        "model": ("model", re.compile(r"[a-z0-9][a-z0-9.-]{0,63}"), "that is not a model alias"),
+        # A model name is whatever the CLI in play calls it: `opus`, but also
+        # `gpt-5.6-sol` and OpenCode's `anthropic/claude-sonnet-4`. Slash,
+        # underscore and colon are in; whitespace, quotes and every shell
+        # metacharacter stay out, because this value ends up on a command line.
+        "model": ("model", re.compile(r"[a-z0-9][a-z0-9./:_-]{0,63}"),
+                  "that is not a model name"),
         "effort": ("effort", frozenset(("low", "medium", "high", "xhigh", "max")),
                    "effort is low..max or empty"),
         "runtime": ("runs", frozenset(("claude",) + seat.OTROS_MOTORES),

package/bin/test

@@ -22,7 +22,7 @@ if [ -d .git ] && [ -x .githooks/pre-commit ] \
     && printf '  pre-commit gate armed (core.hooksPath .githooks)\n'
 fi
 
-SUITES=(widgets card parcels domains busca serve seat cities channel committee live-feed runtime claude-runtime runtime-ui runtime-failures stress adapter benchmark demo contracts exit rutas cage broker evidencia admision pairing hall-protocol doctor security workspace avatar crecimiento atajos navegador actualiza desinstala launch)
+SUITES=(widgets card parcels domains busca arnes i18n serve seat cities channel connect committee live-feed runtime claude-runtime runtime-ui runtime-failures stress adapter benchmark demo contracts exit rutas cage broker evidencia admision pairing hall-protocol doctor security workspace avatar crecimiento atajos navegador actualiza desinstala launch)
 [ $# -gt 0 ] && SUITES=("$@")
 
 fallos=0
@@ -90,16 +90,26 @@ necesarios = ["bin/agents-city.js", "bin/hall", "bin/seat", "bin/city", "bin/dem
               "plugin/scripts/workspace.py", "plugin/scripts/avatar.py",
               "plugin/scripts/crecimiento.py",
               "plugin/scripts/reset.py", "plugin/scripts/desinstala.py",
-              "plugin/scripts/demos.py", "plugin/scripts/capabilities.py",
+              "plugin/scripts/demos.py", "plugin/scripts/arnes.py",
+              "plugin/channel/runtime/arnes.json", "plugin/scripts/capabilities.py",
               "plugin/scripts/deliberations.py",
               "plugin/scripts/runtime_processes.py",
               "plugin/scripts/runtime_log.py", "plugin/scripts/logs.py",
               "plugin/scripts/launch.py", "plugin/scripts/hook_activity.py",
+              "plugin/scripts/reception.py",
               "plugin/scripts/city-session.sh", "plugin/scripts/city-runtime.sh",
               "plugin/scripts/find-repos.sh",
               "plugin/scripts/busca.py",
               "plugin/channel/bus.js", "plugin/channel/local-hub.js",
               "plugin/channel/client.js", "plugin/channel/adapter.js",
+              "plugin/channel/managed-connect-client.js",
+              "plugin/channel/managed-connect-client.d.ts",
+              "plugin/channel/managed-connect-client.manifest.json",
+              "plugin/channel/trust/agents-city-sandbox-roots.json",
+              "plugin/channel/kinsh_vodozemac_wasm_bg.wasm",
+              "plugin/channel/agents_city_hybrid_crypto_bg.wasm",
+              "plugin/channel/licenses/CONNECT_CLIENT_THIRD_PARTY_NOTICES.md",
+              "plugin/channel/managed-connect-cli.js", "bin/connect",
               "plugin/channel/runtime-gateway.js",
               "plugin/.mcp.json",
               "bin/cities", "bin/road", "bin/bus", "bin/committee", "bin/agents",
@@ -111,7 +121,8 @@ necesarios = ["bin/agents-city.js", "bin/hall", "bin/seat", "bin/city", "bin/dem
               "benchmarks/latency/fake-native-server.mjs",
               "benchmarks/latency/fake-claude-cli.mjs",
               "benchmarks/stress/run.py", "benchmarks/stress/README.md",
-              "city/web/src/repo-roles.ts",
+              "benchmarks/reception/run.mjs", "benchmarks/reception/README.md",
+              "city/web/src/repo-roles.ts", "city/web/src/vista.ts",
               "demo/show.py", "demo/city/city.yml", "demo/city/ada.md",
               "city/scripts/seed.py", "city/worker/schema.sql", "demo/parcels.yml"]
 problemas = [f"missing: {n}" for n in necesarios if n not in dentro]

package/bin/test-arnes.py

@@ -0,0 +1,192 @@
+#!/usr/bin/env python3
+"""What this product does to somebody else's CLI, and whether it says so.
+
+The whole pitch is that Agents City orchestrates the CLIs people already run,
+with the plugins, skills, MCP servers and settings they already have. That is a
+claim about someone else's machine, and a claim like that is worth exactly as
+much as the command that checks it.
+
+So there are two things to defend here, and the second is the hard one:
+
+  1. the report reads what is actually on the disk, and never invents a fact
+     about a file it could not read;
+  2. the report and the RUNTIME cannot drift. Every value the connectors impose
+     comes out of `arnes.json`, and nothing is imposed that the declaration does
+     not mention. A product that quietly injects an instruction it does not
+     print is exactly what this file exists to catch — and it caught one while
+     it was being written.
+"""
+
+import json
+import os
+import re
+import sys
+import tempfile
+
+AQUI = os.path.dirname(os.path.abspath(__file__))
+RAIZ = os.path.dirname(AQUI)
+sys.path.insert(0, AQUI)
+sys.path.insert(0, os.path.join(RAIZ, "plugin", "scripts"))
+
+import arnes  # noqa: E402
+from testlib import afirma, comprueba, resumen  # noqa: E402
+
+RUNTIME = os.path.join(RAIZ, "plugin", "channel", "runtime")
+
+
+def la_declaracion():
+    print("  the declaration")
+    motores = arnes.declaracion()
+    afirma("· every runtime the product launches is declared",
+           sorted(motores) == ["claude", "codex", "kimi", "opencode"], str(sorted(motores)))
+    for nombre, motor in motores.items():
+        for clave in ("binario", "config", "trato", "hereda", "respeta"):
+            afirma(f"· {nombre} declares {clave}", clave in motor, str(sorted(motor)))
+        for t in motor["trato"]:
+            afirma(f"· {nombre}/{t['clave']} says how it is applied", bool(t.get("via")), str(t))
+            # The reason is not decoration. Somebody reading this report is
+            # deciding whether to trust the product with their machine, and
+            # "because we do" is not an answer they can weigh.
+            afirma(f"· {nombre}/{t['clave']} says why", len(t.get("porque", "")) > 25, str(t))
+
+
+def sin_deriva():
+    print("  the report cannot drift from the behaviour")
+    # Comments are stripped first. A check that cannot tell a value from a
+    # sentence about that value teaches people to write worse comments, and the
+    # comments in these files are load-bearing.
+    def codigo(nombre):
+        texto = open(os.path.join(RUNTIME, f"{nombre}.ts"), encoding="utf-8").read()
+        texto = re.sub(r"/\*.*?\*/", "", texto, flags=re.S)
+        return "\n".join(l for l in texto.split("\n") if not l.strip().startswith("//"))
+
+    fuentes = {n: codigo(n) for n in ("codex", "kimi", "opencode", "claude")}
+    # Claude's deal is applied by the shell launcher, not by claude.ts. Scanning
+    # only the connectors meant this guard passed VACUOUSLY for the one runtime
+    # whose values were respelled somewhere else — the exact failure it exists
+    # to catch, hiding in the place it could not see.
+    fuentes["claude"] += "\n" + open(
+        os.path.join(RAIZ, "plugin", "scripts", "city-session.sh"), encoding="utf-8"
+    ).read()
+    motores = arnes.declaracion()
+
+    # Every declared value is READ from the declaration, never respelled.
+    for nombre, motor in motores.items():
+        for t in motor["trato"]:
+            valor = t["valor"]
+            if len(valor) < 12:
+                continue  # a short literal like "auto" is not a drift risk
+            afirma(
+                f"· {nombre}/{t['clave']} is not spelled a second time in {nombre}.ts",
+                valor not in fuentes[nombre], f"{valor[:60]}… appears inline",
+            )
+
+    # And nothing is imposed that the declaration does not mention. These are
+    # the shapes a runtime uses to put words or policy into somebody's agent.
+    sospechosas = ("developerInstructions", "system_prompt", "systemPrompt",
+                   "approvalPolicy", "permission_mode", "instructions")
+    for nombre, fuente in fuentes.items():
+        declaradas = {t["clave"] for t in motores.get(nombre, {}).get("trato", [])}
+        # A private method named after the key is how a declared value is read.
+        declaradas |= {c[0].lower() + c[1:] for c in declaradas}
+        for aguja in sospechosas:
+            if not re.search(rf"\b{aguja}\b", fuente):
+                continue
+            afirma(
+                f"· {nombre}.ts sets {aguja}, and the declaration says so",
+                aguja in declaradas or _es_metodo_declarado(aguja, declaradas),
+                f"{aguja} is imposed by {nombre}.ts and missing from arnes.json",
+            )
+
+    # The one sentence the product puts into other people's agents lives in
+    # exactly one file. It used to live in two, and one of them was undeclared.
+    frase = "You are one member of an Agents City committee"
+    fuera = [n for n, f in fuentes.items() if frase in f]
+    afirma("· the committee instruction is written in one place only",
+           not fuera, f"also inline in: {fuera}")
+
+    # And the launcher asks for the deal rather than carrying a copy of it.
+    shell = open(os.path.join(RAIZ, "plugin", "scripts", "city-session.sh"),
+                 encoding="utf-8").read()
+    afirma("· the launcher asks arnes.py for Claude's flags",
+           'arnes.py" flags claude' in shell, "")
+    banderas = arnes.banderas("claude")
+    for trozo in ("--settings", "crossSessionInbound", "--disallowed-tools",
+                  "SendMessage,ListAgents"):
+        afirma(f"· and they are built from the declaration: {trozo}",
+               trozo in banderas, banderas)
+    afirma("· a runtime whose deal is not command-line shaped gets no flags",
+           arnes.banderas("codex") == "" and arnes.banderas("opencode") == "",
+           f"codex={arnes.banderas('codex')!r}")
+
+
+def _es_metodo_declarado(aguja, declaradas):
+    """`approvalPolicy` declared, read through a method of the same name."""
+    return any(aguja.lower() == d.lower() for d in declaradas)
+
+
+def lo_que_hay_en_el_disco():
+    print("  it reads the machine, and admits what it cannot read")
+    casa = tempfile.mkdtemp()
+    toml = os.path.join(casa, "config.toml")
+    open(toml, "w", encoding="utf-8").write(
+        '# a comment\n'
+        'model = "gpt-5.6-sol"\n'
+        "model_reasoning_effort = 'max'\n"
+        "suelto = 3\n"
+        "[features]\n"
+        'oculto = "no debe leerse"\n'
+    )
+    plano = arnes._lee_toml_plano(toml)
+    comprueba("· a quoted value is read", plano.get("model"), "gpt-5.6-sol")
+    comprueba("· single quotes too", plano.get("model_reasoning_effort"), "max")
+    comprueba("· and a bare one", plano.get("suelto"), "3")
+    afirma("· a comment is not a setting", "# a comment" not in plano, str(plano))
+    afirma("· and it stops at the first section rather than guessing",
+           "oculto" not in plano, str(plano))
+    comprueba("· a file that is not there is empty, not an error",
+              arnes._lee_toml_plano(os.path.join(casa, "no-hay")), {})
+
+    print("  it never invents a value")
+    afirma("· a long block is counted, not dumped",
+           arnes.resume({"allow": [1, 2, 3], "deny": []}) == "3 entries",
+           arnes.resume({"allow": [1, 2, 3], "deny": []}))
+    afirma("· a long string is cut, and says it was",
+           arnes.resume("x" * 200).endswith("…"), arnes.resume("x" * 200))
+    comprueba("· a short one is left alone", arnes.resume("auto"), "auto")
+
+
+def el_informe():
+    print("  the report")
+    entradas = arnes.informe(instalado=lambda _b: False)
+    comprueba("· one entry per runtime", len(entradas), 4)
+    afirma("· a CLI that is not on this machine is said to be missing",
+           all(not e["instalado"] for e in entradas), "")
+    salida = []
+    arnes.imprime(entradas, di=salida.append)
+    texto = "\n".join(salida)
+    afirma("· it separates the deal from what it inherits and what it leaves alone",
+           "the deal" in texto and "we inherit" in texto and "untouched" in texto, texto[:400])
+    afirma("· it says the deal is what makes the bus the only route",
+           "the only route" in texto, texto[-400:])
+    afirma("· and how to switch the cage off",
+           "CITY_CAGE=0" in texto, texto[-400:])
+    afirma("· a runtime that imposes nothing says so plainly",
+           "nothing — it runs exactly as you configured it" in texto, texto)
+    # It is a report about somebody's machine: it must survive not finding one.
+    vacio = arnes.informe(instalado=lambda _b: True)
+    afirma("· and it renders on a machine with no configuration at all",
+           len(vacio) == 4, str(len(vacio)))
+    json.dumps(entradas)  # the --json door must stay serialisable
+
+
+def main():
+    la_declaracion()
+    sin_deriva()
+    lo_que_hay_en_el_disco()
+    el_informe()
+    return resumen("arnes")
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/bin/test-cage.py

@@ -66,6 +66,8 @@ def texto_del_perfil():
                "channels" in p and "\\.env" in p)
         afirma("the broker state dir is sealed",
                os.path.join(casa, ".agents-city", ".runtime", "broker") in p)
+        afirma("managed device keys are sealed",
+               os.path.join(casa, ".agents-city", ".runtime", "connect") in p)
         afirma("~/.npmrc stays readable on purpose (a broken npm protects nobody)",
                os.path.join(casa, ".npmrc") not in p)
     finally:
@@ -129,6 +131,8 @@ def excepciones_y_errores():
             p = cage.perfil(repo, casa=casa)
             afirma("the broker seal follows a relocated AGENTS_CITY_HOME",
                    os.path.join(os.path.realpath(relocado), ".runtime", "broker") in p)
+            afirma("the managed-key seal follows a relocated AGENTS_CITY_HOME",
+                   os.path.join(os.path.realpath(relocado), ".runtime", "connect") in p)
             afirma("and the relocated home stays writable",
                    f'(subpath "{os.path.realpath(relocado)}")' in p)
         finally:
@@ -234,6 +238,11 @@ def argv_de_linux():
                i_repo < i_ssh, f"repo at {i_repo}, sealed .ssh at {i_ssh}")
         afirma("a sealed directory becomes an empty tmpfs, not a refusal",
                f"--tmpfs {real(os.path.join(casa, '.ssh'))}" in texto, texto[-400:])
+        connect = real(os.path.join(casa, '.agents-city', '.runtime', 'connect'))
+        os.makedirs(connect, exist_ok=True)
+        con_connect = " ".join(cage.argv_bwrap(repo, casa=casa))
+        afirma("the Linux cage masks managed device keys with an empty filesystem",
+               f"--tmpfs {connect}" in con_connect, con_connect[-500:])
         afirma("a sealed FILE reads as nothing instead",
                f"--ro-bind-try /dev/null {real(os.path.join(casa, '.git-credentials'))}" in texto,
                texto[-400:])