agents-city 0.4.0 → 0.5.2

package/plugin/channel/runtime-gateway.ts

@@ -250,6 +250,18 @@ function startConsole(): void {
     output: process.stdout,
     prompt: 'city> ',
   });
+  // Say what this prompt is before anybody has to guess.
+  //
+  // Claude runs headless behind this gateway so that every turn crosses the
+  // bus and lands in the Hall — which is the whole point, and which also means
+  // the pane is NOT the Claude Code interface somebody was expecting. A bare
+  // `city>` after a wall of startup lines reads as "it failed to open"; it took
+  // exactly one person meeting it for the first time to prove that.
+  process.stdout.write(
+    `\n  This window is ${options.actor}, talking to ${runtime} through the city.\n` +
+      '  Type here to give it work. The full conversation appears in the town hall.\n' +
+      '  /exit closes this window.\n\n',
+  );
   terminal.prompt();
   terminal.on('line', (line) => {
     const prompt = line.trim();

package/plugin/channel/trust/agents-city-sandbox-roots.json

@@ -0,0 +1,66 @@
+{
+  "protocol": "agents-city-key-transparency-root-chain/1",
+  "roots": [
+    {
+      "signed": {
+        "protocol": "agents-city-key-transparency-root/1",
+        "version": 1,
+        "environment": "sandbox",
+        "controlPlaneUrl": "https://agents-city-connect-sandbox.pages.dev",
+        "relayUrl": "wss://agents-city-relay-sandbox.bluebell.workers.dev/v1/connect",
+        "issuedAt": 1788063673370,
+        "expiresAt": 1819686073370,
+        "previousRootHash": null,
+        "keys": {
+          "agents-city-sandbox-operator-v1": {
+            "kty": "OKP",
+            "crv": "Ed25519",
+            "x": "ZIEWw4EUQ3qyoKVowZsl4nJuiVom7EwUMctI8NljFF8",
+            "ext": true
+          },
+          "agents-city-sandbox-root-v1": {
+            "kty": "OKP",
+            "crv": "Ed25519",
+            "x": "S8DifYMze6j2U-tRF_5tkjsXw5cmcFabt8B1X3ON1N8",
+            "ext": true
+          },
+          "agents-city-sandbox-witness-v1": {
+            "kty": "OKP",
+            "crv": "Ed25519",
+            "x": "fErzxNY6ZMfwH98E9F7jbn-tw_nOHVN3B3VodL62m68",
+            "ext": true
+          }
+        },
+        "roles": {
+          "root": {
+            "keyIds": [
+              "agents-city-sandbox-root-v1"
+            ],
+            "threshold": 1
+          },
+          "operator": {
+            "keyIds": [
+              "agents-city-sandbox-operator-v1"
+            ],
+            "threshold": 1
+          },
+          "witness": {
+            "keyIds": [
+              "agents-city-sandbox-witness-v1"
+            ],
+            "threshold": 1
+          }
+        },
+        "maximumHeadAgeMs": 300000,
+        "maximumWitnessLagMs": 30000
+      },
+      "signatures": [
+        {
+          "protocol": "agents-city-key-transparency-root-signature/1",
+          "keyId": "agents-city-sandbox-root-v1",
+          "signature": "llGO2Kr236CfD5JCvaMjvtwW4gG98s-p4gowrKNl_fPKJ9ywPI9m6R_DH9uTbLgt6eGyXiTKxB4QVDWHMAloAg"
+        }
+      ]
+    }
+  ]
+}

package/plugin/scripts/arnes.py

@@ -0,0 +1,271 @@
+#!/usr/bin/env python3
+"""What this product does to the CLIs you already had, on this machine.
+
+The pitch is that Agents City orchestrates the CLIs people already run, with
+the plugins, skills, MCP servers and settings they already configured. That is
+a claim, and a claim about somebody else's machine is worth exactly as much as
+the command that checks it. This is that command's engine.
+
+It reads `plugin/channel/runtime/arnes.json` — the same declaration the
+connectors take their policy values from, so the report cannot describe a
+behaviour the code does not have — and fills it in with what is actually on
+this disk: their real settings file, their real plugins, their real MCP
+servers, their real model.
+
+Three columns, and the distinction between them is the whole point:
+
+  el trato    what we add or override. Short, deliberate, and the reason the
+              product works at all: without it the bus is not the only route
+              and the cage does not hold.
+  heredamos   what we deliberately do NOT send, so their own CLI reads their
+              own configuration for it.
+  respetamos  what loads untouched.
+"""
+
+import json
+import os
+
+AQUI = os.path.dirname(os.path.abspath(__file__))
+RAIZ = os.path.dirname(os.path.dirname(AQUI))
+DECLARACION = os.path.join(RAIZ, "plugin", "channel", "runtime", "arnes.json")
+
+
+def declaracion():
+    try:
+        with open(DECLARACION, encoding="utf-8") as f:
+            return json.load(f).get("motores", {})
+    except (OSError, ValueError):
+        return {}
+
+
+def _expande(ruta):
+    return os.path.expanduser(ruta)
+
+
+def _lee_json(ruta):
+    try:
+        with open(_expande(ruta), encoding="utf-8") as f:
+            return json.load(f)
+    except (OSError, ValueError):
+        return None
+
+
+def _lee_toml_plano(ruta):
+    """Top-level `key = value` pairs, which is where the settings that matter
+    live. The same deliberately small reader the Codex connector uses, so the
+    two agree about what they can see."""
+    fuera = {}
+    try:
+        with open(_expande(ruta), encoding="utf-8") as f:
+            for linea in f:
+                linea = linea.strip()
+                if linea.startswith("["):
+                    break
+                if not linea or linea.startswith("#") or "=" not in linea:
+                    continue
+                clave, valor = linea.split("=", 1)
+                fuera[clave.strip()] = valor.strip().strip("\"'")
+    except OSError:
+        return {}
+    return fuera
+
+
+def resume(valor):
+    """One of their values, as a line somebody can read.
+
+    A permissions block is forty rules and a nested dict; printing it raw turns
+    a report into a wall and buries the three lines that matter. Structure is
+    counted, scalars are shown, and a long string is cut — but never silently:
+    what is cut says so.
+    """
+    if isinstance(valor, dict):
+        cuantos = sum(len(v) if isinstance(v, list) else 1 for v in valor.values())
+        return f"{cuantos} entries"
+    if isinstance(valor, list):
+        return f"{len(valor)} entries"
+    texto = str(valor)
+    return texto if len(texto) <= 60 else texto[:57] + "…"
+
+
+def _suyo(config):
+    """Their configuration, as far as we can honestly read it."""
+    for ruta in config:
+        if ruta.endswith(".toml"):
+            datos = _lee_toml_plano(ruta)
+            if datos:
+                return ruta, datos
+        else:
+            datos = _lee_json(ruta)
+            if datos:
+                return ruta, datos
+    return (config[0] if config else ""), {}
+
+
+def _cuenta_claude(datos):
+    """What their Claude actually loads, counted rather than assumed."""
+    fuera = {}
+    plugins = datos.get("enabledPlugins")
+    if isinstance(plugins, dict):
+        fuera["plugins"] = sum(1 for v in plugins.values() if v)
+    permisos = datos.get("permissions")
+    if isinstance(permisos, dict):
+        reglas = sum(len(v) for v in permisos.values() if isinstance(v, list))
+        if reglas:
+            fuera["permission rules"] = reglas
+    mcp = _lee_json("~/.claude.json")
+    if isinstance(mcp, dict) and isinstance(mcp.get("mcpServers"), dict):
+        fuera["MCP servers"] = len(mcp["mcpServers"])
+    return fuera
+
+
+def informe(instalado=None):
+    """The whole table, one entry per runtime, ready to print or to serve.
+
+    `instalado` is injected so the report can be built on a machine that has
+    none of them — a test, or a person reading the docs — without pretending
+    they are there.
+    """
+    if instalado is None:
+        import shutil
+
+        def instalado(binario):
+            return bool(shutil.which(binario))
+
+    fuera = []
+    for nombre, motor in sorted(declaracion().items()):
+        ruta, datos = _suyo(motor.get("config", []))
+        # A flat reader over a TOML file sees the top level and stops.
+        parcial = ruta.endswith(".toml") and bool(datos)
+        hereda = []
+        for h in motor.get("hereda", []):
+            valor = datos.get(h["suyo"])
+            hereda.append(
+                {
+                    "clave": h["suyo"],
+                    "cuando": h.get("cuando", ""),
+                    "valor": "" if valor is None else resume(valor),
+                    # Found, or merely not found HERE? This reader sees the top
+                    # level of a TOML file and stops, so a key it did not find
+                    # may be absent or may be inside a `[section]`. Saying "not
+                    # set" would be the report inventing a fact about somebody
+                    # else's machine.
+                    "leido": h["suyo"] in datos,
+                }
+            )
+        avisos = []
+        for aviso in motor.get("avisa", []):
+            clave, _, esperado = aviso["cuando"].partition(" = ")
+            if esperado and str(datos.get(clave.strip(), "")) == esperado.strip():
+                avisos.append(aviso["dice"])
+        entrada = {
+            "motor": nombre,
+            "binario": motor.get("binario", nombre),
+            "instalado": instalado(motor.get("binario", nombre)),
+            "config": ruta,
+            "hay_config": bool(datos),
+            "trato": motor.get("trato", []),
+            "hereda": hereda,
+            "respeta": motor.get("respeta", []),
+            "avisos": avisos,
+            # A property of the FILE, not of each key read out of it.
+            "parcial": parcial,
+        }
+        if nombre == "claude" and datos:
+            entrada["cuenta"] = _cuenta_claude(datos)
+        fuera.append(entrada)
+    return fuera
+
+
+def banderas(nombre):
+    """The declared deal for one runtime, as command-line flags.
+
+    Claude's half of the deal used to live as two shell literals in
+    `city-session.sh` while `arnes.json` declared the same three values — so
+    the drift guard, which only scans the connectors, passed **vacuously** for
+    the one runtime whose values were actually respelled somewhere else. The
+    launcher asks for them now, which makes the declaration true for all four
+    instead of two.
+
+      settings  a key in the `--settings` layer Claude merges on top of theirs
+      flag      a flag of its own, `--kebab-case-of-the-key value`
+    """
+    motor = declaracion().get(nombre, {})
+    ajustes, flags = {}, []
+    for t in motor.get("trato", []):
+        valor = t["valor"]
+        if t.get("rinde") == "settings":
+            ajustes[t["clave"]] = {"true": True, "false": False}.get(valor, valor)
+        elif t.get("rinde") == "flag":
+            guion = "".join("-" + c.lower() if c.isupper() else c for c in t["clave"])
+            flags.append(f"--{guion} {valor}")
+    partes = []
+    if ajustes:
+        partes.append("--settings " + json.dumps(ajustes, separators=(",", ":")))
+    partes += flags
+    return " ".join(partes)
+
+
+#: Enough for the widest label in the report ("we inherit", "untouched").
+ANCHO = 13
+
+
+def _linea(etiqueta, texto):
+    return f"    {etiqueta.ljust(ANCHO)}{texto}"
+
+
+def imprime(entradas, di=print):
+    """The report, as somebody deciding whether to trust this would read it."""
+    di("\n  What Agents City does to the CLIs you already have\n")
+    for e in entradas:
+        estado = "" if e["instalado"] else "  (not installed here)"
+        di(f"  {e['motor']}{estado}")
+        if not e["trato"]:
+            di(_linea("the deal", "nothing — it runs exactly as you configured it"))
+        for t in e["trato"]:
+            suyo = f"  · yours wins ({t['suyo']})" if t.get("suyo") else ""
+            di(_linea("the deal", f"{t['clave']} = {resume(t['valor'])}{suyo}"))
+            di(_linea("", f"  via {t['via']}"))
+            di(_linea("", f"  because {t['porque']}"))
+        for h in e["hereda"]:
+            if h["valor"]:
+                valor = f" = {h['valor']}"
+            elif not e["hay_config"]:
+                valor = ""
+            elif not e["parcial"]:
+                valor = " (not set)"
+            else:
+                valor = " (not at the top level; this reader stops at [sections])"
+            di(_linea("we inherit", f"{h['clave']}{valor}  · {h['cuando']}"))
+        if e["respeta"]:
+            di(_linea("untouched", ", ".join(e["respeta"])))
+        for clave, cuantos in (e.get("cuenta") or {}).items():
+            di(_linea("", f"{cuantos} {clave} on this machine"))
+        if e["hay_config"]:
+            di(_linea("read from", e["config"]))
+        for aviso in e["avisos"]:
+            di(_linea("careful", aviso))
+        di("")
+    di("  The deal is what makes the bus the only route and the cage hold.")
+    di("  CITY_CAGE=0 removes the cage. Everything else above is yours.\n")
+
+
+def main(argv=None):
+    import sys
+
+    argv = sys.argv[1:] if argv is None else argv
+    # `arnes.py flags <runtime>` is what the launcher asks, so the deal it
+    # applies and the deal this reports are one answer.
+    if argv[:1] == ["flags"]:
+        print(banderas(argv[1] if len(argv) > 1 else ""))
+        return 0
+    entradas = informe()
+    if "--json" in argv:
+        json.dump(entradas, sys.stdout, ensure_ascii=False, indent=1)
+        print()
+    else:
+        imprime(entradas)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/plugin/scripts/busca.py

@@ -86,7 +86,23 @@ SALTAR = {
 
 #: What counts as a document. Deliberately short: the question is "is there
 #: writing in here", not "can this folder be indexed".
-DOCUMENTOS = (".md", ".markdown", ".txt", ".rst", ".org", ".pdf", ".docx", ".doc", ".rtf")
+#:
+#: One answer, shared with `crecimiento`, which grows a knowledge agent's house
+#: by counting the same files. Two lists here meant a visible contradiction: a
+#: folder of `.adoc` was never offered as a knowledge house and yet grew one
+#: once mounted by hand.
+DOCUMENTOS = (
+    ".md",
+    ".markdown",
+    ".txt",
+    ".rst",
+    ".org",
+    ".adoc",
+    ".pdf",
+    ".doc",
+    ".docx",
+    ".rtf",
+)
 
 #: A folder needs this many documents before it is worth offering. Two loose
 #: readmes are not a knowledge base.
@@ -350,17 +366,22 @@ def _lee():
     return sitios
 
 
-def caduco(dias=1):
+#: How long the index is trusted. A day: long enough that nobody pays for the
+#: crawl twice in a sitting, short enough that yesterday's clones show up.
+VIDA = 86400
+
+
+def caduco():
     try:
-        return time.time() - os.path.getmtime(fichero_cache()) > dias * 86400
+        return time.time() - os.path.getmtime(fichero_cache()) > VIDA
     except OSError:
         return True
 
 
-def lugares(refrescar=False, dias=1):
+def lugares(refrescar=False):
     """Every place, from the cache while it is fresh. The first crawl of a full
     home directory is not fast and nobody should pay for it twice."""
-    if not refrescar and not caduco(dias):
+    if not refrescar and not caduco():
         guardado = _lee()
         if guardado is not None:
             return guardado
@@ -379,11 +400,26 @@ def repos(refrescar=False):
 
 def ruta_de(nombre):
     """One place's path by name, rebuilding the index once if it is not there —
-    the repo somebody cloned a minute ago is exactly the one they came to use."""
-    for intento in (False, True):
-        for s in lugares(refrescar=intento):
-            if s["nombre"] == nombre:
-                return s["ruta"]
+    the repo somebody cloned a minute ago is exactly the one they came to use.
+
+    Once, though. The launcher resolves every name on a card, each in its own
+    process, so a card with three stale names used to mean three full crawls of
+    the home directory in a row: the rebuild triggered by the first name is not
+    going to make the second one appear. An index rebuilt seconds ago is
+    treated as the answer.
+    """
+    for s in lugares():
+        if s["nombre"] == nombre:
+            return s["ruta"]
+    try:
+        recien = time.time() - os.path.getmtime(fichero_cache()) < 30
+    except OSError:
+        recien = False
+    if recien:
+        return ""
+    for s in lugares(refrescar=True):
+        if s["nombre"] == nombre:
+            return s["ruta"]
     return ""
 
 

package/plugin/scripts/cage.py

@@ -136,6 +136,11 @@ def sellados_por_tipo(casa):
     for f in SECRETOS_FICHERO:
         fuera[rutas.canonicaliza(os.path.join(casa, f))] = 'file'
     fuera[rutas.canonicaliza(os.path.join(ac, '.runtime', 'broker'))] = 'dir'
+    # Managed Roads use a device-held Ed25519 signing key and X25519 decryption
+    # key. Repo-agent windows never need either: the local hub is started by the
+    # human-facing connect command and owns the outbound session. Seal the whole
+    # state directory on both kernels, including before it exists.
+    fuera[rutas.canonicaliza(os.path.join(ac, '.runtime', 'connect'))] = 'dir'
     for f in ('credentials', 'credentials.toml'):
         fuera[rutas.canonicaliza(os.path.join(casa, '.cargo', f))] = 'file'
     # An owner's own denies: nothing declares their kind, so ask the disk and