agents-city 0.4.0 → 0.5.2

package/plugin/scripts/city-session.sh

@@ -100,11 +100,19 @@ if tmux has-session -t "$SESSION" 2>/dev/null; then
   exec tmux attach -d -t "$SESSION"
 fi
 
-# Claude's native cross-session path is explicitly closed. The city bus is the
-# only route, so Claude, Codex, OpenCode and Kimi obey the same topology.
-# skipDangerousModePermissionPrompt only suppresses Claude's local yolo notice.
-SETTINGS='{"crossSessionInbound":"refuse","skipDangerousModePermissionPrompt":true}'
-NO_PEER_TOOLS=' --disallowed-tools SendMessage,ListAgents'
+# Claude's half of the deal, asked for rather than respelled.
+#
+# `arnes.json` declares what this product adds to somebody else's CLI, and
+# `agents-city doctor --config` prints that declaration as a promise about their
+# machine. These two lines used to be a second spelling of it — which meant the
+# drift guard, which reads the connectors, could not see the one runtime whose
+# values live here. One `python3` in a script that already runs dozens buys the
+# promise being true for all four runtimes instead of two.
+#
+# What it contains: Claude's native cross-session path closed and its peer tools
+# denied, so the city bus is the only route; and the local yolo notice
+# suppressed, which grants nothing.
+CLAUDE_TRATO=" $(python3 "$(dirname "$0")/arnes.py" flags claude)"
 YOLO_FLAG=""
 [ "$YOLO" -eq 1 ] && YOLO_FLAG=" --dangerously-skip-permissions"
 
@@ -195,17 +203,82 @@ jaula_de() {  # window, cwd, [broker token file], [colon-joined mount targets] -
 # then the card's per-window key (`model.dbt:`), then the card's default
 # (`model:`). Nothing set means no flag at all — the owner's Claude default,
 # which is the right silence.
-motor_de() {  # $1 = window name -> prints the extra claude flags
-  local ventana="$1" modelo esfuerzo salida=""
-  modelo="${CITY_MODEL:-$(python3 "$LEER" "$FICHA" "model.$ventana")}"
-  [ -z "$modelo" ] && modelo="$(python3 "$LEER" "$FICHA" model)"
-  esfuerzo="${CITY_EFFORT:-$(python3 "$LEER" "$FICHA" "effort.$ventana")}"
-  [ -z "$esfuerzo" ] && esfuerzo="$(python3 "$LEER" "$FICHA" effort)"
+# Used only by con_motor below, which is the single entry point: a window whose
+# card says `model.dbt` must get it whichever of the six launch branches it
+# lands in, and one of them used to give it nothing at all.
+motor_de() {  # $1 = window name, $2 = runtime (default claude) -> extra flags
+  local ventana="$1" cual="${2:-claude}" modelo esfuerzo salida="" cuatro
+  # Four fields, one interpreter — and none at all when the window loop has
+  # already read this window's card line. This used to be four `python3` starts
+  # each re-parsing the same small card, per window; a city with eighteen agents
+  # paid seventy-two of them before tmux attached.
+  if [ "$ventana" = "${CARTA_VENTANA:-}" ]; then
+    # Already read, by the loop that is launching this very window.
+    cuatro="$(printf '%s' "$CARTA_DATOS" | sed -n '3,6p')"
+  else
+    cuatro="$(python3 "$LEER" --varios "$FICHA" \
+      "model.$ventana" model "effort.$ventana" effort)"
+  fi
+  modelo="${CITY_MODEL:-$(printf '%s' "$cuatro" | sed -n 1p)}"
+  [ -z "$modelo" ] && modelo="$(printf '%s' "$cuatro" | sed -n 2p)"
+  esfuerzo="${CITY_EFFORT:-$(printf '%s' "$cuatro" | sed -n 3p)}"
+  [ -z "$esfuerzo" ] && esfuerzo="$(printf '%s' "$cuatro" | sed -n 4p)"
   [ -n "$modelo" ] && salida=" --model $modelo"
-  [ -n "$esfuerzo" ] && salida="$salida --effort $esfuerzo"
+  # Only where it is actually read. Claude takes it as a CLI flag; Codex's
+  # gateway parses it out of the command and sends it with the turn. OpenCode
+  # and Kimi have no such setting, and writing a flag nothing reads is how a
+  # control ends up looking like it works.
+  if [ -n "$esfuerzo" ]; then
+    case "$cual" in claude|codex) salida="$salida --effort $esfuerzo" ;; esac
+  fi
   printf '%s' "$salida"
 }
 
+# The card says which model a window runs, once, whatever CLI runs it. Claude
+# takes these as flags; the native gateways parse the very same spelling out of
+# the command string and send it with the turn — which is why one key on the
+# card can mean the same thing for all four. A command that already carries the
+# flag keeps it: somebody who wrote `runs.dbt: codex --model x` said what they
+# meant, and a generic key must not overrule a specific sentence.
+con_motor() {  # $1 = window, $2 = runtime, $3 = the command
+  local ventana="$1" cual="$2" orden="$3" extra
+  extra="$(motor_de "$ventana" "$cual")"
+  case "$orden" in
+    *" --model "*|*" -m "*) extra="$(printf '%s' "$extra" | sed 's/ --model [^ ]*//')" ;;
+  esac
+  case "$orden" in
+    *" --effort "*) extra="$(printf '%s' "$extra" | sed 's/ --effort [^ ]*//')" ;;
+  esac
+  printf '%s%s' "$orden" "$extra"
+}
+
+# How a window's Claude is presented: its own interface, or the city's prompt.
+#
+#   tui       Claude Code as you run it by hand — your plugins, your statusline,
+#             your slash commands. It reaches the bus through the city plugin's
+#             SessionStart/UserPromptSubmit/Stop hooks, which report the same
+#             `conversation.*` events the gateway reports.
+#   gateway   Claude headless behind the city gateway, driven from a `city>`
+#             prompt. The bus can PUSH work into it, which is what an agent
+#             house needs and a chair does not.
+#
+# The seat defaults to `tui` because the seat is where a person works by hand,
+# and taking their own harness away to give them a bare prompt was the wrong
+# trade. `ui.seat: gateway` on the card, or CITY_UI, puts the old shape back.
+#
+# Agent houses are NOT asked: a house exists to receive assignments from the
+# bus, and the gateway is what makes that possible. The helper takes a window
+# and a default because that is the honest shape of the question — but only the
+# chair asks it, and the docs say only that.
+ui_de() {  # $1 = window, $2 = default -> tui | gateway
+  local elegido
+  elegido="${CITY_UI:-$(python3 "$LEER" "$FICHA" "ui.$1")}"
+  case "$elegido" in
+    tui|gateway) printf '%s' "$elegido" ;;
+    *) printf '%s' "$2" ;;
+  esac
+}
+
 runtime_de() {  # configured command -> claude | codex | opencode | kimi | terminal | unknown
   local raw="$1" first
   case "$raw" in terminal:*) printf 'terminal'; return ;; esac
@@ -399,10 +472,52 @@ tmux set-environment -t "$SESSION" AGENTS_CITY_USER "$USUARIO" 2>/dev/null
 tmux set-environment -t "$SESSION" CITY_ADDRESS "$ADDRESS" 2>/dev/null
 tmux set-environment -t "$SESSION" CITY_SEAT_NAME "$SEAT_NAME" 2>/dev/null
 
+# What every window is told about the city it belongs to.
+#
+# This was spelled out seven times, in seven three-hundred-column lines, and two
+# of the copies existed only because the seat's non-Claude branches bypassed the
+# helper that already had it. Adding one variable meant finding all seven.
+#
+# The chair and a house differ in exactly three keys: a house carries its
+# operating role and has the remote-road variables blanked, because a road is
+# the seat's to hold; the chair carries its bus agent instead.
+entorno_de() {  # $1 = actor ("seat" or a window name)
+  local actor="$1" propio
+  if [ "$actor" = seat ]; then
+    propio="CITY_BUS_ACTOR=seat CITY_RUNTIME_KIND=seat CITY_BUS_AGENT=$AGENTE "
+  else
+    propio="CITY_BUS_ACTOR=$actor CITY_AGENT_ROLE=$ROL_REPO CITY_RUNTIME_KIND=repo CITY_BUS_URL= CITY_BUS_TOKEN= "
+  fi
+  printf '%s%s' "$(sync_line)AGENTS_CITY_DATA=$EQUIPO AGENTS_CITY_HOME=${AGENTS_CITY_HOME:-$HOME/.agents-city} AGENTS_CITY_USER=$USUARIO CITY_ADDRESS=$ADDRESS CITY_SEAT_NAME=$SEAT_NAME " "$propio"
+}
+
+# The chair's Claude, opened the way the card asks for.
+#
+# Both spellings carry the SAME flags. That matters: `--settings` closes
+# Claude's own cross-session inbound and `--disallowed-tools` removes the peer
+# tools, and those two are what make the city bus the only route between
+# agents. A TUI without them would be a quieter product with a hole in it.
+lanza_asiento_claude() {  # $1 = the full claude command
+  local orden="$1" entorno
+  entorno="$(entorno_de seat)"
+  if [ "$(ui_de seat tui)" = tui ]; then
+    # Claude Code itself, in the pane. The city plugin is installed at user
+    # scope, so its hooks report this session's prompts and answers onto the
+    # bus exactly as the gateway would; the difference is that the city cannot
+    # push a prompt in, and instead types one through the registered fallback.
+    lanza "$SESSION:seat" seat "$EQUIPO" "$entorno${CLAUDE_AUTH_PREFIX}$orden"
+    "$RUNTIME" fallback seat "$SESSION:seat" claude
+  else
+    lanza "$SESSION:seat" seat "$EQUIPO" \
+      "$entorno${CLAUDE_AUTH_PREFIX}$(gateway_line seat "$EQUIPO" "$orden" "$SEAT_AUTO")"
+  fi
+}
+
 # The seat runs Claude unless the card says otherwise. `runs.seat` is the same key
 # the repo windows use, and it makes a city with no Claude in it possible at all:
 # what that seat gives up is the `/city:` commands, which are Claude's, and what it
 # keeps is the folder, the identity, and everything the terminal does.
+CARTA_VENTANA=""   # set by the window loop below; the seat is not in it
 SEAT_OTRO="$(python3 "$LEER" "$FICHA" "runs.seat")"
 turno=0
 [ -n "$SEAT_OTRO" ] && [ "$(runtime_de "$SEAT_OTRO")" != claude ] && turno=-1
@@ -411,25 +526,22 @@ if [ "$RUN_CLAUDE" -eq 1 ]; then
   if [ -n "$SEAT_OTRO" ]; then
     SEAT_RUNTIME="$(runtime_de "$SEAT_OTRO")"
     if [ "$SEAT_RUNTIME" = claude ]; then
-      CLAUDE_SEAT="$SEAT_OTRO --name $SEAT_NAME --settings '$SETTINGS'$NO_PEER_TOOLS$SEAT_YOLO_FLAG"
-      lanza "$SESSION:seat" seat "$EQUIPO" \
-        "$(sync_line)AGENTS_CITY_DATA=$EQUIPO AGENTS_CITY_HOME=${AGENTS_CITY_HOME:-$HOME/.agents-city} AGENTS_CITY_USER=$USUARIO CITY_ADDRESS=$ADDRESS CITY_SEAT_NAME=$SEAT_NAME CITY_BUS_ACTOR=seat CITY_RUNTIME_KIND=seat CITY_BUS_AGENT=$AGENTE ${CLAUDE_AUTH_PREFIX}$(gateway_line seat "$EQUIPO" "$CLAUDE_SEAT" "$SEAT_AUTO")"
+      CLAUDE_SEAT="$(con_motor seat claude "$SEAT_OTRO --name $SEAT_NAME")$CLAUDE_TRATO$SEAT_YOLO_FLAG"
+      lanza_asiento_claude "$CLAUDE_SEAT"
     elif [ "$SEAT_RUNTIME" = codex ] || [ "$SEAT_RUNTIME" = opencode ] || [ "$SEAT_RUNTIME" = kimi ]; then
       lanza "$SESSION:seat" seat "$EQUIPO" \
-        "$(sync_line)AGENTS_CITY_DATA=$EQUIPO AGENTS_CITY_HOME=${AGENTS_CITY_HOME:-$HOME/.agents-city} AGENTS_CITY_USER=$USUARIO CITY_ADDRESS=$ADDRESS CITY_SEAT_NAME=$SEAT_NAME CITY_BUS_ACTOR=seat CITY_RUNTIME_KIND=seat CITY_BUS_AGENT=$AGENTE $(gateway_line seat "$EQUIPO" "$SEAT_OTRO" "$SEAT_AUTO")"
+        "$(entorno_de seat)$(gateway_line seat "$EQUIPO" "$(con_motor seat "$SEAT_RUNTIME" "$SEAT_OTRO")" "$SEAT_AUTO")"
     elif [ "$SEAT_RUNTIME" = terminal ]; then
       SEAT_COMMAND="${SEAT_OTRO#terminal:}"
       lanza "$SESSION:seat" seat "$EQUIPO" \
-        "$(sync_line)AGENTS_CITY_DATA=$EQUIPO AGENTS_CITY_HOME=${AGENTS_CITY_HOME:-$HOME/.agents-city} AGENTS_CITY_USER=$USUARIO CITY_ADDRESS=$ADDRESS CITY_SEAT_NAME=$SEAT_NAME CITY_BUS_ACTOR=seat CITY_RUNTIME_KIND=seat CITY_BUS_AGENT=$AGENTE $SEAT_COMMAND"
+        "$(entorno_de seat)$SEAT_COMMAND"
       "$RUNTIME" fallback seat "$SESSION:seat" "${SEAT_COMMAND%% *}"
     else
       tmux send-keys -t "$SESSION:seat" \
         "echo 'No native Agents City gateway for: $SEAT_OTRO. Use terminal:$SEAT_OTRO only if you explicitly accept terminal injection.'" C-m
     fi
   else
-    CLAUDE_SEAT="claude --name $SEAT_NAME$(motor_de seat) --settings '$SETTINGS'$NO_PEER_TOOLS$SEAT_YOLO_FLAG"
-    lanza "$SESSION:seat" seat "$EQUIPO" \
-      "$(sync_line)AGENTS_CITY_DATA=$EQUIPO AGENTS_CITY_HOME=${AGENTS_CITY_HOME:-$HOME/.agents-city} AGENTS_CITY_USER=$USUARIO CITY_ADDRESS=$ADDRESS CITY_SEAT_NAME=$SEAT_NAME CITY_BUS_ACTOR=seat CITY_RUNTIME_KIND=seat CITY_BUS_AGENT=$AGENTE ${CLAUDE_AUTH_PREFIX}$(gateway_line seat "$EQUIPO" "$CLAUDE_SEAT" "$SEAT_AUTO")"
+    lanza_asiento_claude "$(con_motor seat claude "claude --name $SEAT_NAME")$CLAUDE_TRATO$SEAT_YOLO_FLAG"
   fi
 fi
 
@@ -463,7 +575,11 @@ for path in ${RUTAS[@]+"${RUTAS[@]}"}; do
   # Professional specialty is separate from bus authority. Every repo actor is
   # still a member; only `seat` is chair. A malformed or legacy value resolves
   # to the explicit blank role in read-card.py.
-  ROL_REPO="$(python3 "$LEER" --actor-role "$FICHA" "$win")"
+  # One read for this whole window: its role, what runs there, and the engine.
+  # Three interpreters per window used to re-parse the same card three times.
+  CARTA_VENTANA="$win"
+  CARTA_DATOS="$(python3 "$LEER" --ventana "$FICHA" "$win")"
+  ROL_REPO="$(printf '%s' "$CARTA_DATOS" | sed -n 1p)"
   # This window's cage and, when the broker runs, its own single-repo token.
   # The token travels as a file path, never on the command line, and the cage
   # profile re-allows reading exactly that file and nothing else in the broker.
@@ -479,16 +595,16 @@ for path in ${RUTAS[@]+"${RUTAS[@]}"}; do
   [ -n "$JAULA" ] && CAGE_RUNTIME_ENV="env CITY_OUTER_CAGE=1 "
   tmux new-window -t "$SESSION" -n "$win" -c "$path"
   if [ "$RUN_CLAUDE" -eq 1 ]; then
-    OTRO="$(python3 "$LEER" "$FICHA" "runs.$win")"
+    OTRO="$(printf '%s' "$CARTA_DATOS" | sed -n 2p)"
     if [ -n "$OTRO" ]; then
       KIND="$(runtime_de "$OTRO")"
       if [ "$KIND" = claude ]; then
         espera="$(retraso "$turno")"
         turno=$((turno + 1))
         if [ "$espera" = "0" ]; then espera=''; else espera="sleep $espera; "; fi
-        CLAUDE_REPO="$OTRO --name $SESSION-$win --settings '$SETTINGS'$NO_PEER_TOOLS$YOLO_FLAG"
+        CLAUDE_REPO="$(con_motor "$win" claude "$OTRO --name $SESSION-$win")$CLAUDE_TRATO$YOLO_FLAG"
         lanza "$SESSION:$win" "$win" "$path" \
-          "$espera$(sync_line)AGENTS_CITY_DATA=$EQUIPO AGENTS_CITY_HOME=${AGENTS_CITY_HOME:-$HOME/.agents-city} AGENTS_CITY_USER=$USUARIO CITY_ADDRESS=$ADDRESS CITY_SEAT_NAME=$SEAT_NAME CITY_BUS_ACTOR=$win CITY_AGENT_ROLE=$ROL_REPO CITY_RUNTIME_KIND=repo CITY_BUS_URL= CITY_BUS_TOKEN= $BROKER_ENV$JAULA$CAGE_RUNTIME_ENV${CLAUDE_AUTH_PREFIX}$(gateway_line "$win" "$path" "$CLAUDE_REPO")"
+          "$espera$(entorno_de "$win")$BROKER_ENV$JAULA$CAGE_RUNTIME_ENV${CLAUDE_AUTH_PREFIX}$(gateway_line "$win" "$path" "$CLAUDE_REPO")"
       elif [ "$KIND" = codex ] || [ "$KIND" = opencode ] || [ "$KIND" = kimi ]; then
         # Native servers have their own credentials and do not share Claude's OAuth race.
         # Codex stays outside the outer cage ON macOS ONLY: its node_repl MCP
@@ -505,11 +621,11 @@ for path in ${RUTAS[@]+"${RUTAS[@]}"}; do
           RUNTIME_CAGE_ENV=""
         fi
         lanza "$SESSION:$win" "$win" "$path" \
-          "$(sync_line)AGENTS_CITY_DATA=$EQUIPO AGENTS_CITY_HOME=${AGENTS_CITY_HOME:-$HOME/.agents-city} AGENTS_CITY_USER=$USUARIO CITY_ADDRESS=$ADDRESS CITY_SEAT_NAME=$SEAT_NAME CITY_BUS_ACTOR=$win CITY_AGENT_ROLE=$ROL_REPO CITY_RUNTIME_KIND=repo CITY_BUS_URL= CITY_BUS_TOKEN= $BROKER_ENV$RUNTIME_CAGE$RUNTIME_CAGE_ENV$(gateway_line "$win" "$path" "$OTRO")"
+          "$(entorno_de "$win")$BROKER_ENV$RUNTIME_CAGE$RUNTIME_CAGE_ENV$(gateway_line "$win" "$path" "$(con_motor "$win" "$KIND" "$OTRO")")"
       elif [ "$KIND" = terminal ]; then
         FALLBACK_COMMAND="${OTRO#terminal:}"
         lanza "$SESSION:$win" "$win" "$path" \
-          "$(sync_line)AGENTS_CITY_DATA=$EQUIPO AGENTS_CITY_HOME=${AGENTS_CITY_HOME:-$HOME/.agents-city} AGENTS_CITY_USER=$USUARIO CITY_ADDRESS=$ADDRESS CITY_SEAT_NAME=$SEAT_NAME CITY_BUS_ACTOR=$win CITY_AGENT_ROLE=$ROL_REPO CITY_RUNTIME_KIND=repo CITY_BUS_URL= CITY_BUS_TOKEN= $BROKER_ENV$JAULA$FALLBACK_COMMAND"
+          "$(entorno_de "$win")$BROKER_ENV$JAULA$FALLBACK_COMMAND"
         "$RUNTIME" fallback "$win" "$SESSION:$win" "${FALLBACK_COMMAND%% *}"
       else
         tmux send-keys -t "$SESSION:$win" \
@@ -519,9 +635,9 @@ for path in ${RUTAS[@]+"${RUTAS[@]}"}; do
       espera="$(retraso "$turno")"
       turno=$((turno + 1))
       if [ "$espera" = "0" ]; then espera=''; else espera="sleep $espera; "; fi
-      CLAUDE_REPO="claude --name $SESSION-$win$(motor_de "$win") --settings '$SETTINGS'$NO_PEER_TOOLS$YOLO_FLAG"
+      CLAUDE_REPO="$(con_motor "$win" claude "claude --name $SESSION-$win")$CLAUDE_TRATO$YOLO_FLAG"
       lanza "$SESSION:$win" "$win" "$path" \
-        "$espera$(sync_line)AGENTS_CITY_DATA=$EQUIPO AGENTS_CITY_HOME=${AGENTS_CITY_HOME:-$HOME/.agents-city} AGENTS_CITY_USER=$USUARIO CITY_ADDRESS=$ADDRESS CITY_SEAT_NAME=$SEAT_NAME CITY_BUS_ACTOR=$win CITY_AGENT_ROLE=$ROL_REPO CITY_RUNTIME_KIND=repo CITY_BUS_URL= CITY_BUS_TOKEN= $BROKER_ENV${JAULA}$CAGE_RUNTIME_ENV${CLAUDE_AUTH_PREFIX}$(gateway_line "$win" "$path" "$CLAUDE_REPO")"
+        "$espera$(entorno_de "$win")$BROKER_ENV${JAULA}$CAGE_RUNTIME_ENV${CLAUDE_AUTH_PREFIX}$(gateway_line "$win" "$path" "$CLAUDE_REPO")"
     fi
   fi
 done

package/plugin/scripts/crecimiento.py

@@ -21,6 +21,7 @@ filesystem; the git-backed `code` counter is injected so this module needs no
 network and stays trivially testable.
 """
 
+import busca  # it owns what counts as a document
 import os
 import time
 
@@ -28,7 +29,9 @@ import deliberations
 import workspace
 
 #: Extensions that count as a knowledge document.
-DOC_EXT = ('.md', '.txt', '.rst', '.org', '.pdf', '.doc', '.docx', '.adoc')
+#: What a knowledge house grows on. `busca` owns the list, because the same
+#: question decides which folders the picker offers as one in the first place.
+DOC_EXT = busca.DOCUMENTOS
 DIAS_RECIENTE = 30
 _SEG_RECIENTE = DIAS_RECIENTE * 24 * 3600
 

package/plugin/scripts/demos.py

@@ -17,21 +17,25 @@ AQUI = os.path.dirname(os.path.abspath(__file__))
 RAIZ = os.path.dirname(os.path.dirname(AQUI))
 DEMO = os.path.join(RAIZ, "demo")
 
-#: What each story is, in the words somebody choosing one would use. The domain
-#: is the one the wizard offers, so "see it in my own field" means something.
-DOMINIOS = {
-    "software": ("Software", "Aurora Games"),
-    "medicina": ("Healthcare", "Clínica Alba"),
-    "legal": ("Legal", "Costa & Ley"),
-}
+#: The one thing about a demo that lives nowhere else: the label for the field
+#: it belongs to. Everything else — which stories exist, what each is called,
+#: which city it happens in — is read from `stories.py` and from the fixture's
+#: own `city.yml`, because those already own it. A table repeating them meant a
+#: fourth story was invisible in the Hall until somebody remembered this dict,
+#: and renaming a demo city made the shelf quietly lie.
+ETIQUETAS = {"software": "Software", "medicina": "Healthcare", "legal": "Legal"}
 
 
 def carpeta():
     return os.path.join(DEMO, "grabaciones")
 
 
-def _titulos():
-    """The story titles, read from the stories module when it is installed."""
+def _historias():
+    """The stories themselves, when the demo folder is installed.
+
+    An install can be trimmed. A Hall whose demo shelf is empty should say so
+    rather than fail to load, so this returns nothing rather than raising.
+    """
     import sys
 
     if DEMO not in sys.path:
@@ -39,31 +43,39 @@ def _titulos():
     try:
         from stories import STORIES  # noqa: PLC0415
 
-        return {k: v.get("title", k) for k, v in STORIES.items()}
+        return STORIES
     except (ImportError, AttributeError):
         return {}
 
 
+def ficha(ident, eventos_=None):
+    """One demo's card, built from one parse of its recording.
+
+    `eventos_` lets a caller that already has the events avoid reading the file
+    again — which is the difference between the shelf costing one pass per demo
+    and the endpoint costing four to serve one of them.
+    """
+    import cities
+
+    historia = _historias().get(ident)
+    ruta = os.path.join(carpeta(), f"{ident}.jsonl")
+    if historia is None or not os.path.isfile(ruta):
+        return None
+    if eventos_ is None:
+        eventos_ = _carga(ruta)
+    return {
+        "id": ident,
+        "dominio": ETIQUETAS.get(ident, ident),
+        "ciudad": cities.nombre(os.path.join(DEMO, historia.get("city", ""))),
+        "titulo": historia.get("title", ident),
+        "turnos": len(eventos_),
+        "reparto": _reparto(eventos_),
+    }
+
+
 def catalogo():
     """Every demo with a recording on disk, in a stable order."""
-    titulos = _titulos()
-    fuera = []
-    for ident in sorted(DOMINIOS):
-        ruta = os.path.join(carpeta(), f"{ident}.jsonl")
-        if not os.path.isfile(ruta):
-            continue
-        dominio, ciudad = DOMINIOS[ident]
-        fuera.append(
-            {
-                "id": ident,
-                "dominio": dominio,
-                "ciudad": ciudad,
-                "titulo": titulos.get(ident, ident),
-                "turnos": _cuenta(ruta),
-                "reparto": _reparto(ruta),
-            }
-        )
-    return fuera
+    return [f for f in (ficha(i) for i in sorted(_historias())) if f]
 
 
 def _lineas(ruta):
@@ -77,18 +89,27 @@ def _lineas(ruta):
         return
 
 
-def _cuenta(ruta):
-    return sum(1 for _ in _lineas(ruta))
-
+def _carga(ruta):
+    """One recording, read and parsed once.
 
-def _reparto(ruta):
-    """Who speaks in this story, in the order they first do."""
-    visto = []
+    The catalogue used to walk each file twice — once to count turns, once for
+    the cast — and then the endpoint parsed the chosen one a third time. Three
+    passes over the same small file to answer three questions about it.
+    """
+    fuera = []
     for linea in _lineas(ruta):
         try:
-            actor = json.loads(linea).get("actor", "")
+            fuera.append(json.loads(linea))
         except json.JSONDecodeError:
             continue
+    return fuera
+
+
+def _reparto(eventos_):
+    """Who speaks in this story, in the order they first do."""
+    visto = []
+    for evento in eventos_:
+        actor = evento.get("actor", "")
         if actor and actor not in visto:
             visto.append(actor)
     return visto
@@ -96,12 +117,6 @@ def _reparto(ruta):
 
 def eventos(ident):
     """One recording, as the list of activity events it holds."""
-    if ident not in DOMINIOS:
+    if ident not in _historias():
         return []
-    fuera = []
-    for linea in _lineas(os.path.join(carpeta(), f"{ident}.jsonl")):
-        try:
-            fuera.append(json.loads(linea))
-        except json.JSONDecodeError:
-            continue
-    return fuera
+    return _carga(os.path.join(carpeta(), f"{ident}.jsonl"))

package/plugin/scripts/desinstala.py

@@ -28,41 +28,56 @@ import sys
 AQUI = os.path.dirname(os.path.abspath(__file__))
 sys.path.insert(0, AQUI)
 import atajos  # noqa: E402  the desktop icons, one per city
+import busca  # noqa: E402  it owns where the disk index is cached
 import cities  # noqa: E402
 import city_env  # noqa: E402  where the bus keeps its folder
 
 def _sitios():
     """Everything on disk that belongs to the product and to nothing else, as
     (what it is, absolute path, whether it holds your cities)."""
-    casa = os.path.expanduser("~")
-    cache = os.environ.get("XDG_CACHE_HOME") or os.path.join(casa, ".cache")
     return [
         ("your cities, their state and their backups", cities.raiz(), True),
         ("the list of which cities exist", os.path.dirname(cities.REGISTRO), False),
-        ("the cached index of your disk", os.path.join(cache, "agents-city"), False),
+        # Every entry here asks the module that owns the path. This one used to
+        # respell the cache rule, which meant moving the cache would silently
+        # leave it behind — the exact failure "everything it ever wrote" exists
+        # to prevent, and the kind nobody notices.
+        ("the cached index of your disk", os.path.dirname(busca.fichero_cache()), False),
         ("the bus folder, its .env and its hooks", city_env.CANAL, False),
     ]
 
 
 def _tamano(ruta):
-    """How much is there, without following a single link out of it."""
-    if not os.path.exists(ruta):
+    """How much is there, without following a single link out of it.
+
+    Walked with `scandir`, whose entries already carry the type and size the
+    directory read fetched — `islink` plus `getsize` per file was two extra
+    syscalls each for an answer we were being handed.
+    """
+    if os.path.islink(ruta):
         return 0
-    if os.path.islink(ruta) or os.path.isfile(ruta):
-        return 0 if os.path.islink(ruta) else os.path.getsize(ruta)
+    if os.path.isfile(ruta):
+        return os.path.getsize(ruta)
     total = 0
-    for base, dirs, ficheros in os.walk(ruta):
-        # A symlinked directory is somebody's repository. It is not ours to
-        # measure, and it is certainly not ours to delete.
-        dirs[:] = [d for d in dirs if not os.path.islink(os.path.join(base, d))]
-        for f in ficheros:
-            ruta_f = os.path.join(base, f)
-            if os.path.islink(ruta_f):
-                continue
-            try:
-                total += os.path.getsize(ruta_f)
-            except OSError:
-                continue
+    pila = [ruta]
+    while pila:
+        try:
+            with os.scandir(pila.pop()) as it:
+                for e in it:
+                    try:
+                        if e.is_symlink():
+                            # A symlinked directory is somebody's repository. It
+                            # is not ours to measure, and certainly not ours to
+                            # delete.
+                            continue
+                        if e.is_dir(follow_symlinks=False):
+                            pila.append(e.path)
+                        else:
+                            total += e.stat(follow_symlinks=False).st_size
+                    except OSError:
+                        continue
+        except OSError:
+            continue
     return total
 
 
@@ -76,9 +91,9 @@ def _tamano_legible(n):
     return f"{valor:.0f} {unidades[i]}" if i == 0 else f"{valor:.1f} {unidades[i]}"
 
 
-def plan(usuario="", conservar_ciudades=False, con_npm=False):
+def plan(conservar_ciudades=False, con_npm=False):
     """What would be removed, in the order it would be removed."""
-    usuario = usuario or cities.usuario_actual()
+    usuario = cities.usuario_actual()
     pasos = [{"que": "stop every city session, hall and map this product started",
               "clase": "procesos"}]
     for datos in [c["ruta"] for c in cities.lista(usuario)]:

package/plugin/scripts/diario.py

@@ -0,0 +1,119 @@
+#!/usr/bin/env python3
+"""What happened, written down, so a failure on somebody else's machine is not a
+story they have to remember.
+
+The Hall had no log at all. It answered the browser with an error, the browser
+put a toast on screen, the toast went away, and there was nothing left. When
+somebody said "it says the name is empty and the name is right there", the only
+honest answer was "reproduce it for me" — which is asking a person to debug
+their own bug report.
+
+So: one file, always written, per city.
+
+    ~/.agents-city/.runtime/bus/<city>/hall.jsonl
+
+One JSON object per line, oldest first. The browser writes into the same file
+as the server, because half of these failures happen in the browser and a log
+that stops at the network boundary tells half a story.
+
+Two things it must never do. It must not grow without bound — it rotates at two
+megabytes and keeps one previous file, which is enough to see what happened and
+not enough to matter. And it must not record a secret: `agents-city doctor
+--report` exists so somebody can send this to a stranger, and a log that has to
+be read before it is sent is a log nobody sends.
+"""
+
+import json
+import os
+import re
+import time
+
+#: Rotate here. Small enough that the file is readable, large enough to hold a
+#: session's worth of a person clicking around.
+LIMITE = 2 * 1024 * 1024
+
+#: Anything whose NAME says it is a credential. Matched on the key, because the
+#: value of a token looks like the value of an id.
+SECRETO = re.compile(
+    r"pase|token|secret|password|passwd|authorization|cookie|api[_-]?key|credential",
+    re.I,
+)
+
+#: And anything shaped like one wherever it turns up: a long unbroken run of
+#: hex or base64. Slashes are NOT part of it — a temp directory is a long run
+#: of characters with slashes in it, and redacting `/var/folders/...` turned a
+#: useful error message into `[redacted]` while protecting nothing.
+PARECE_CLAVE = re.compile(r"(?<![\w./-])[A-Za-z0-9+_-]{32,}={0,2}(?![\w./-])")
+
+
+def ruta(datos):
+    import runtime_processes
+
+    return os.path.join(runtime_processes.ruta(datos), "hall.jsonl")
+
+
+def limpia(valor, profundidad=0):
+    """The same value with anything that looks like a credential taken out.
+
+    Applied on the way IN, not on the way out: a secret that reaches the file
+    has already been written to somebody's disk, and the promise this makes is
+    that the file is safe to attach to an issue without reading it first.
+    """
+    if profundidad > 6:
+        return "…"
+    if isinstance(valor, dict):
+        return {
+            k: ("[redacted]" if SECRETO.search(str(k)) else limpia(v, profundidad + 1))
+            for k, v in list(valor.items())[:40]
+        }
+    if isinstance(valor, (list, tuple)):
+        return [limpia(v, profundidad + 1) for v in valor[:40]]
+    if isinstance(valor, str):
+        recortado = valor if len(valor) <= 500 else valor[:497] + "…"
+        return PARECE_CLAVE.sub("[redacted]", recortado)
+    return valor
+
+
+def _rota(fichero):
+    try:
+        if os.path.getsize(fichero) < LIMITE:
+            return
+    except OSError:
+        return
+    try:
+        os.replace(fichero, fichero + ".1")
+    except OSError:
+        pass
+
+
+def apunta(datos, tipo, **campos):
+    """One line. Never raises: a log that can break the thing it is logging is
+    worse than no log, and this is called from inside request handlers."""
+    try:
+        fichero = ruta(datos)
+        os.makedirs(os.path.dirname(fichero), exist_ok=True)
+        _rota(fichero)
+        linea = {"t": time.strftime("%Y-%m-%dT%H:%M:%S"), "tipo": tipo}
+        linea.update(limpia(campos))
+        with open(fichero, "a", encoding="utf-8") as f:
+            f.write(json.dumps(linea, ensure_ascii=False) + "\n")
+    except (OSError, TypeError, ValueError):
+        pass
+
+
+def lee(datos, cuantas=200):
+    """The last `cuantas` entries, oldest first, across the rotation."""
+    fuera = []
+    for fichero in (ruta(datos) + ".1", ruta(datos)):
+        try:
+            with open(fichero, encoding="utf-8") as f:
+                fuera.extend(l.strip() for l in f if l.strip())
+        except OSError:
+            continue
+    salida = []
+    for linea in fuera[-cuantas:]:
+        try:
+            salida.append(json.loads(linea))
+        except json.JSONDecodeError:
+            salida.append({"tipo": "unreadable", "linea": linea[:200]})
+    return salida