agents-city 0.4.0 → 0.5.2

package/plugin/channel/road-cli.ts

@@ -5,7 +5,7 @@ export async function roadBusCli(args: string[]): Promise<unknown> {
   if (['help', '-h', '--help'].includes(verb)) {
     return {
       usage: 'agents-city bus <roster | inbox | send owner/city text>',
-      note: 'Only the seat can cross a road; repo agents are rejected by the bus ACL.',
+      note: 'Only the seat can cross a road. Inbox returns a bounded batch so a burst never becomes one model turn per message.',
     };
   }
   if (verb === 'roster') return busCommand('road.roster');

package/plugin/channel/runtime/arnes.json

@@ -0,0 +1,189 @@
+{
+  "protocolo": "agents-city-arnes/1",
+  "_": [
+    "What this product does to somebody else's CLI, declared once.",
+    "",
+    "The pitch is that we orchestrate the CLIs people already have, with the",
+    "plugins, skills, MCP servers and settings they already configured. That is",
+    "only true if it can be audited, and it can only be audited if the runtime",
+    "and the report read the SAME file. So they do: `codex.ts` takes its policy",
+    "values from `trato` below, and `agents-city doctor --config` prints this",
+    "same table filled in with what is actually on the machine. Change a value",
+    "here and both move together; there is nowhere for a claim to drift from a",
+    "behaviour.",
+    "",
+    "  trato    what we add or override, and why. This is the deal: without it",
+    "           the bus is not the only route and the cage does not hold. It is",
+    "           deliberately short, and every line of it is printable.",
+    "  hereda   what we deliberately do NOT send, so their own CLI reads their",
+    "           own configuration for it.",
+    "  respeta  what loads untouched."
+  ],
+  "motores": {
+    "claude": {
+      "binario": "claude",
+      "config": [
+        "~/.claude/settings.json",
+        "~/.claude/settings.local.json"
+      ],
+      "trato": [
+        {
+          "clave": "crossSessionInbound",
+          "valor": "refuse",
+          "via": "--settings (an added layer, not a replacement)",
+          "porque": "the city bus is the only route between agents; Claude's own cross-session path would be a second one nobody can see",
+          "rinde": "settings"
+        },
+        {
+          "clave": "disallowedTools",
+          "valor": "SendMessage,ListAgents",
+          "via": "--disallowed-tools",
+          "porque": "same reason, from the other side: an agent must not reach a peer directly",
+          "rinde": "flag"
+        },
+        {
+          "clave": "skipDangerousModePermissionPrompt",
+          "valor": "true",
+          "via": "--settings",
+          "porque": "suppresses Claude's local yolo notice only; it does not grant anything",
+          "rinde": "settings"
+        }
+      ],
+      "hereda": [
+        {
+          "suyo": "model",
+          "cuando": "no `model.<window>` on the card"
+        },
+        {
+          "suyo": "effortLevel",
+          "cuando": "no `effort.<window>` on the card"
+        },
+        {
+          "suyo": "permissions",
+          "cuando": "always, unless this city runs yolo"
+        }
+      ],
+      "respeta": [
+        "plugins",
+        "skills",
+        "MCP servers",
+        "statusline",
+        "theme",
+        "hooks",
+        "output styles"
+      ]
+    },
+    "codex": {
+      "binario": "codex",
+      "config": [
+        "~/.codex/config.toml"
+      ],
+      "trato": [
+        {
+          "clave": "developerInstructions",
+          "valor": "You are one member of an Agents City committee. Never contact repo peers directly; submit evidence through the agents-city committee CLI named in each assignment.",
+          "via": "thread configuration",
+          "porque": "the committee is chaired: a member that answers its peers directly is not being moderated by anybody"
+        },
+        {
+          "clave": "sandbox",
+          "valor": "workspace-write",
+          "via": "thread configuration and every turn",
+          "porque": "the cage: writes stay inside the workspace. `alterno` instead when an outer cage is already holding, or when CITY_CAGE=0 turns it off deliberately",
+          "alterno": "danger-full-access"
+        },
+        {
+          "clave": "approvalPolicy",
+          "valor": "on-request",
+          "via": "thread configuration and every turn",
+          "porque": "the default when their config says nothing. `never` rejects anything needing approval, which silently disables app and MCP tools",
+          "suyo": "approval_policy"
+        }
+      ],
+      "hereda": [
+        {
+          "suyo": "model",
+          "cuando": "no `model.<window>` on the card"
+        },
+        {
+          "suyo": "model_reasoning_effort",
+          "cuando": "no `effort.<window>` on the card"
+        },
+        {
+          "suyo": "approval_policy",
+          "cuando": "they set one"
+        },
+        {
+          "suyo": "personality",
+          "cuando": "always"
+        },
+        {
+          "suyo": "features",
+          "cuando": "always"
+        }
+      ],
+      "respeta": [
+        "MCP servers",
+        "profiles",
+        "personality",
+        "features",
+        "notify"
+      ],
+      "avisa": [
+        {
+          "cuando": "approval_policy = never",
+          "dice": "your Codex will refuse anything needing approval, app and MCP tools included"
+        }
+      ]
+    },
+    "opencode": {
+      "binario": "opencode",
+      "config": [
+        "~/.config/opencode/opencode.json"
+      ],
+      "trato": [],
+      "hereda": [
+        {
+          "suyo": "model",
+          "cuando": "no `model.<window>` on the card"
+        }
+      ],
+      "respeta": [
+        "agents",
+        "providers",
+        "MCP servers",
+        "keybinds"
+      ]
+    },
+    "kimi": {
+      "binario": "kimi",
+      "config": [
+        "~/.kimi/config.json"
+      ],
+      "trato": [
+        {
+          "clave": "system_prompt",
+          "valor": "You are one member of an Agents City committee. Never contact repo peers directly; submit evidence through the agents-city committee CLI named in each assignment.",
+          "via": "agent_config, when the session is created",
+          "porque": "the committee is chaired: a member that answers its peers directly is not being moderated by anybody"
+        },
+        {
+          "clave": "permission_mode",
+          "valor": "manual",
+          "via": "agent_config, on the session and on every turn",
+          "porque": "what a turn gets when nothing asks for more: it stops for approval. `auto` when the command says --auto, `yolo` when this city runs yolo or the command says --yolo"
+        }
+      ],
+      "hereda": [
+        {
+          "suyo": "model",
+          "cuando": "no `model.<window>` on the card"
+        }
+      ],
+      "respeta": [
+        "providers",
+        "MCP servers"
+      ]
+    }
+  }
+}

package/plugin/channel/runtime/arnes.ts

@@ -0,0 +1,47 @@
+/**
+ * The harness declaration, in the runtimes' own language.
+ *
+ * `arnes.json` is the single source of truth for what this product adds to
+ * somebody else's CLI. The connectors read their policy values from here rather
+ * than spelling them inline, so `agents-city doctor --config` can print the
+ * same table and be believed: there is one place to change, and both move.
+ */
+import declaracion from './arnes.json' with { type: 'json' };
+
+export interface Trato {
+  clave: string;
+  valor: string;
+  via: string;
+  porque: string;
+  /** Their own config key, when this one is a default they can outrank. */
+  suyo?: string;
+  /** The other value this key takes, when the choice is ours to compute. */
+  alterno?: string;
+}
+
+interface Motor {
+  binario: string;
+  config: string[];
+  trato: Trato[];
+  hereda: Array<{ suyo: string; cuando: string }>;
+  respeta: string[];
+  avisa?: Array<{ cuando: string; dice: string }>;
+}
+
+const MOTORES = (declaracion as { motores: Record<string, Motor> }).motores;
+
+/** The same value in the app-server's camelCase spelling: `workspace-write`
+ * and `workspaceWrite` are one decision written twice, and only one of them
+ * gets to be the source. */
+export function camello(valor: string): string {
+  return valor.replace(/-([a-z])/g, (_, letra: string) => letra.toUpperCase());
+}
+
+/** One declared value, by runtime and key. Throws rather than guess: a missing
+ * entry means the declaration and the code have parted ways, which is the one
+ * thing this file exists to prevent. */
+export function trato(nombre: string, clave: string): Trato {
+  const encontrado = MOTORES[nombre]?.trato.find((t) => t.clave === clave);
+  if (!encontrado) throw new Error(`arnes.json declares no ${clave} for ${nombre}`);
+  return encontrado;
+}

package/plugin/channel/runtime/claude.ts

@@ -17,6 +17,7 @@ interface ClaudeTurn {
   timer: NodeJS.Timeout;
   resolveAcceptance: (at: string) => void;
   rejectAcceptance: (error: Error) => void;
+  releaseTurn: () => void;
 }
 
 /**
@@ -33,6 +34,7 @@ export class ClaudeConnector implements RuntimeConnector {
   private stderrTail = '';
   private sessionId = '';
   private turns: ClaudeTurn[] = [];
+  private turnDone: Promise<void> = Promise.resolve();
   private closing = false;
   private ready = false;
   private fatalError: Error | null = null;
@@ -123,8 +125,20 @@ export class ClaudeConnector implements RuntimeConnector {
   }
 
   async accept(prompt: string, envelope: BusEnvelope): Promise<NativeAcceptance> {
+    // Claude's stream-json transport acknowledges input before the model has
+    // finished its turn. Serialize here, as the Codex/OpenCode/Kimi connectors
+    // already do, so a busy seat applies durable local backpressure instead of
+    // starting an unbounded number of concurrent model turns.
+    const previousTurn = this.turnDone;
+    let releaseTurn: () => void = () => {};
+    const currentTurn = new Promise<void>((resolve) => {
+      releaseTurn = resolve;
+    });
+    this.turnDone = previousTurn.then(() => currentTurn);
+    await previousTurn;
     const child = this.child;
     if (!this.ready || !child?.stdin?.writable) {
+      releaseTurn();
       throw this.fatalError || new Error('Claude stream connector is not ready');
     }
     const uuid = randomUUID();
@@ -151,6 +165,7 @@ export class ClaudeConnector implements RuntimeConnector {
       }, acknowledgementTimeoutMs()),
       resolveAcceptance,
       rejectAcceptance,
+      releaseTurn,
     };
     this.turns.push(turn);
     const input = {
@@ -184,6 +199,7 @@ export class ClaudeConnector implements RuntimeConnector {
 
   async close(): Promise<void> {
     this.closing = true;
+    this.ready = false;
     const child = this.child;
     this.child = null;
     for (const turn of this.turns) {
@@ -326,6 +342,7 @@ export class ClaudeConnector implements RuntimeConnector {
     turn.completed = true;
     clearTimeout(turn.timer);
     this.turns = this.turns.filter((candidate) => candidate !== turn);
+    turn.releaseTurn();
   }
 
   private currentTurn(): ClaudeTurn | undefined {
@@ -337,6 +354,7 @@ export class ClaudeConnector implements RuntimeConnector {
     if (!turn.acknowledged) turn.rejectAcceptance(error);
     turn.completed = true;
     this.turns = this.turns.filter((candidate) => candidate !== turn);
+    turn.releaseTurn();
   }
 
   private errorOutput(chunk: string): void {

package/plugin/channel/runtime/codex-config.ts

@@ -1,6 +1,56 @@
 import { spawnSync } from 'child_process';
 import { delimiter, isAbsolute, resolve } from 'path';
-import { existsSync } from 'fs';
+import { existsSync, readFileSync } from 'fs';
+import { homedir } from 'os';
+import { join } from 'path';
+
+/**
+ * One top-level string out of the owner's `~/.codex/config.toml`.
+ *
+ * Not a TOML parser, and not pretending to be one: it reads `key = "value"`
+ * lines before the first `[table]` and nothing else, which is exactly where
+ * `model`, `model_reasoning_effort` and `approval_policy` live. Anything it
+ * cannot read confidently comes back empty, and empty means "we did not find
+ * a preference", never "they have none" — the difference matters, because the
+ * caller uses it to decide whether to impose a default.
+ */
+const LEIDO = new Map<string, string>();
+
+export function ownerCodexSetting(key: string): string {
+  const path = process.env.CODEX_HOME
+    ? join(process.env.CODEX_HOME, 'config.toml')
+    : join(homedir(), '.codex', 'config.toml');
+  // Remembered for the life of the gateway. This is consulted on every accepted
+  // turn, and it is a setting the app-server was already started with: reading
+  // and splitting the whole file per turn bought nothing it did not already
+  // have.
+  const recordado = LEIDO.get(`${path}\u0000${key}`);
+  if (recordado !== undefined) return recordado;
+  const valor = _leeAjuste(path, key);
+  LEIDO.set(`${path}\u0000${key}`, valor);
+  return valor;
+}
+
+function _leeAjuste(path: string, key: string): string {
+  let text: string;
+  try {
+    text = readFileSync(path, 'utf8');
+  } catch {
+    return '';
+  }
+  for (const raw of text.split('\n')) {
+    const line = raw.trim();
+    if (line.startsWith('[')) break; // past the top level
+    if (!line || line.startsWith('#')) continue;
+    const equals = line.indexOf('=');
+    if (equals < 0) continue;
+    if (line.slice(0, equals).trim() !== key) continue;
+    const value = line.slice(equals + 1).trim();
+    const quoted = /^"([^"]*)"$/.exec(value) || /^'([^']*)'$/.exec(value);
+    return quoted ? quoted[1] : value;
+  }
+  return '';
+}
 
 interface McpEntry {
   name?: unknown;

package/plugin/channel/runtime/codex.ts

@@ -4,6 +4,8 @@ import { resolve } from 'path';
 import { BusEnvelope } from '../protocol.js';
 import { NativeAcceptance } from '../runtime-metrics.js';
 import { executableFor, hasOption, optionValue } from './command.js';
+import { camello, trato } from './arnes.js';
+import { ownerCodexSetting } from './codex-config.js';
 import { WebSocketJsonRpc } from './json-rpc.js';
 import { freeLoopbackPort, spawnNative, terminate, wait } from './process.js';
 import { ConnectorOptions, NativeUiCommand, RuntimeActivity, RuntimeConnector } from './types.js';
@@ -189,10 +191,7 @@ export class CodexConnector implements RuntimeConnector {
           clientUserMessageId: envelope.id,
           ...(model ? { model } : {}),
           ...(effort ? { effort } : {}),
-          // Keep approval requests enabled so the gateway can approve them in
-          // yolo mode. `never` means "reject anything needing approval", which
-          // silently disabled app/MCP tools even when the owner chose yolo.
-          approvalPolicy: 'on-request',
+          approvalPolicy: this.approvalPolicy(),
           // Same decoupling as thread/start: yolo keeps its speed (no
           // approvals, network open) while writes stay inside the workspace.
           // CITY_CAGE=0 restores the old fully-open behaviour, deliberately.
@@ -380,17 +379,37 @@ export class CodexConnector implements RuntimeConnector {
     const model = optionValue(this.options.command, ['--model', '-m']);
     return {
       ...(model ? { model } : {}),
-      approvalPolicy: 'on-request',
+      approvalPolicy: this.approvalPolicy(),
       // Approval and confinement are different axes: auto-approve means "do
       // not ask", never "touch everything". Writes stay inside the workspace
       // unless the owner explicitly lowers the cage with CITY_CAGE=0.
-      sandbox: this.providerSandboxIsOuterCaged() ? 'danger-full-access' : 'workspace-write',
-      developerInstructions:
-        'You are one member of an Agents City committee. Never contact repo peers directly; ' +
-        'submit evidence through the agents-city committee CLI named in each assignment.',
+      sandbox: this.providerSandboxIsOuterCaged()
+        ? String(trato('codex', 'sandbox').alterno)
+        : trato('codex', 'sandbox').valor,
+      developerInstructions: trato('codex', 'developerInstructions').valor,
     };
   }
 
+  /**
+   * How this Codex asks for permission.
+   *
+   * Theirs wins. `on-request` is only what we fall back to when their config
+   * says nothing — and it is what the declaration says it is, so the doctor's
+   * report cannot claim one thing while this claims another.
+   *
+   * Their `never` is honoured even though it rejects anything needing approval
+   * and so disables app and MCP tools: that is their machine and their choice.
+   * `doctor --config` says the consequence out loud rather than this quietly
+   * deciding they did not mean it.
+   */
+  private approvalPolicy(): string {
+    const declarado = trato('codex', 'approvalPolicy');
+    // Their key is named by the declaration too — `suyo` is precisely "the
+    // setting of theirs this one defers to", and naming it twice is how the
+    // two stop meaning the same thing.
+    return ownerCodexSetting(String(declarado.suyo)) || declarado.valor;
+  }
+
   private autoApprove(): boolean {
     return (
       this.options.autoApprove ||
@@ -403,9 +422,10 @@ export class CodexConnector implements RuntimeConnector {
   }
 
   private sandboxPolicy(): Record<string, unknown> {
-    if (this.providerSandboxIsOuterCaged()) return { type: 'dangerFullAccess' };
+    if (this.providerSandboxIsOuterCaged())
+      return { type: camello(String(trato('codex', 'sandbox').alterno)) };
     return {
-      type: 'workspaceWrite',
+      type: camello(trato('codex', 'sandbox').valor),
       networkAccess: this.autoApprove(),
       writableRoots: [],
     };

package/plugin/channel/runtime/kimi.ts

@@ -3,6 +3,7 @@ import WebSocket from 'ws';
 import { BusEnvelope, randomId } from '../protocol.js';
 import { NativeAcceptance } from '../runtime-metrics.js';
 import { executableFor, hasOption, optionValue } from './command.js';
+import { trato } from './arnes.js';
 import { freeLoopbackPort, spawnNative, terminate, wait, waitForHttp } from './process.js';
 import { ConnectorOptions, RuntimeConnector } from './types.js';
 
@@ -59,9 +60,7 @@ export class KimiConnector implements RuntimeConnector {
           agent_config: {
             ...(model ? { model } : {}),
             permission_mode: this.permissionMode(),
-            system_prompt:
-              'You are one member of an Agents City committee. Never contact repo peers directly; ' +
-              'submit evidence through the agents-city committee CLI named in each assignment.',
+            system_prompt: trato('kimi', 'system_prompt').valor,
           },
         }),
       }),
@@ -119,11 +118,14 @@ export class KimiConnector implements RuntimeConnector {
     this.child = null;
   }
 
+  /** The fallback is the declaration's, so `doctor --config` cannot promise one
+   * mode while this returns another — which it did: the declaration said `auto`
+   * and this said `manual`. */
   private permissionMode(): 'auto' | 'yolo' | 'manual' {
     if (hasOption(this.options.command, ['--auto'])) return 'auto';
     if (this.options.autoApprove || hasOption(this.options.command, ['--yolo', '-y']))
       return 'yolo';
-    return 'manual';
+    return trato('kimi', 'permission_mode').valor as 'auto' | 'yolo' | 'manual';
   }
 
   private auth(): Record<string, string> {

package/plugin/channel/runtime-files.ts

@@ -1,5 +1,17 @@
 import { randomBytes } from 'crypto';
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'fs';
+import {
+  chmodSync,
+  closeSync,
+  constants,
+  existsSync,
+  fsyncSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  renameSync,
+  unlinkSync,
+  writeFileSync,
+} from 'fs';
 import { dirname, join } from 'path';
 import { CityContext } from './city-config.js';
 import { ActorCredential, HubEndpoint, safeSegment } from './protocol.js';
@@ -7,13 +19,35 @@ import { ActorCredential, HubEndpoint, safeSegment } from './protocol.js';
 let counter = 0;
 
 export function atomicJson(path: string, value: unknown): void {
-  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+  const directory = dirname(path);
+  mkdirSync(directory, { recursive: true, mode: 0o700 });
   const tmp = `${path}.tmp-${process.pid}-${counter++}`;
-  writeFileSync(tmp, JSON.stringify(value, null, 2) + '\n', { mode: 0o600 });
-  renameSync(tmp, path);
   try {
+    const fd = openSync(tmp, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 0o600);
+    try {
+      writeFileSync(fd, JSON.stringify(value, null, 2) + '\n');
+      fsyncSync(fd);
+    } finally {
+      closeSync(fd);
+    }
+    renameSync(tmp, path);
     chmodSync(path, 0o600);
-  } catch {}
+    try {
+      const dirFd = openSync(directory, constants.O_RDONLY);
+      try {
+        fsyncSync(dirFd);
+      } finally {
+        closeSync(dirFd);
+      }
+    } catch {
+      // The file itself is synced; a few filesystems do not fsync directories.
+    }
+  } catch (error) {
+    try {
+      unlinkSync(tmp);
+    } catch {}
+    throw error;
+  }
 }
 
 export function actorCredential(context: CityContext, actor: string): ActorCredential {