agents-city 0.5.1 → 0.5.2

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "city",
       "source": "./plugin",
-      "version": "0.5.1",
+      "version": "0.5.2",
       "description": "Operate one autonomous city seat, its domain, role, repo support agents, goal, recognised skills and explicit roads to other cities."
     }
   ]

package/bin/navegador.mjs

@@ -553,6 +553,114 @@ async function main() {
       JSON.stringify(demo?.dice),
     );
 
+    // Building a house for real: type a name, press the button, get a house.
+    //
+    // The suite used to open this form, check its fields existed and press
+    // Escape — so the one thing it is FOR was never exercised. What that hid:
+    // the roles list arrives a few hundred milliseconds after the form opens,
+    // the form repainted when it did, and the repaint redrew the name field
+    // from a state that had never been told what was typed in it. Typing while
+    // that answer was in flight lost the name, and then the button said to
+    // give it one. Intermittent, which is the worst kind.
+    //
+    // So this types IMMEDIATELY, before the roles can land, which is exactly
+    // what a person does.
+    const construida = await cdp.evalua(`(async () => {
+      const espera = async (sel, n = 40) => {
+        for (let i = 0; i < n; i++) {
+          const el = document.querySelector(sel);
+          if (el) return el;
+          await new Promise(r => setTimeout(r, 250));
+        }
+        return null;
+      };
+      const ir = [...document.querySelectorAll('nav li')].find(l => /houses|casas/i.test(l.textContent));
+      ir?.click();
+      await new Promise(r => setTimeout(r, 600));
+      document.getElementById('altaAgente')?.click();
+      const campo = await espera('.dlgFondo #bvNombre');
+      if (!campo) return { falta: true };
+      // Straight away: the roles request is still in flight right now.
+      campo.value = 'urgencias';
+      campo.dispatchEvent(new Event('input', { bubbles: true }));
+      // Long enough for that answer to land and do whatever it does.
+      await new Promise(r => setTimeout(r, 1500));
+      const sobrevive = (document.querySelector('.dlgFondo #bvNombre') || {}).value;
+      const boton = document.querySelector('.dlgFondo [data-dlg="si"]');
+      boton?.click();
+      const leeNombres = () =>
+        [...document.querySelectorAll('.fichaRPG h3')].map(h => h.textContent.trim());
+      // Wait for the house, not for a guess at how long building takes. A
+      // fixed sleep here made this check itself flaky, which is the one thing
+      // a check for a flaky bug must not be.
+      let nombres = [];
+      for (let i = 0; i < 60; i++) {
+        nombres = leeNombres();
+        if (!document.querySelector('.dlgFondo') && nombres.includes('urgencias')) break;
+        await new Promise(r => setTimeout(r, 250));
+      }
+      return { sobrevive, cerrado: !document.querySelector('.dlgFondo'), nombres };
+    })()`);
+    comprueba(
+      'a name typed while the roles are still loading is still there afterwards',
+      construida?.sobrevive === 'urgencias',
+      JSON.stringify(construida),
+    );
+    comprueba(
+      'and pressing build actually builds the house',
+      !!construida?.cerrado && (construida?.nombres ?? []).includes('urgencias'),
+      JSON.stringify(construida),
+    );
+
+    // And the other half: pressing build with nothing in the name.
+    //
+    // The failure this guards is not "it refuses" — it is refusing SILENTLY, or
+    // refusing while closing the dialog, which loses everything the person had
+    // already chosen. That is the same complaint from the other side: a form
+    // that says no and takes the work with it.
+    const vacia = await cdp.evalua(`(async () => {
+      const espera = async (sel, n = 40) => {
+        for (let i = 0; i < n; i++) {
+          const el = document.querySelector(sel);
+          if (el) return el;
+          await new Promise(r => setTimeout(r, 250));
+        }
+        return null;
+      };
+      const antes = document.querySelectorAll('.fichaRPG h3').length;
+      document.getElementById('altaAgente')?.click();
+      const campo = await espera('.dlgFondo #bvNombre');
+      if (!campo) return { falta: true };
+      // Choose something first: whatever it says, this must not be thrown away.
+      document.querySelector('.dlgFondo [data-bv=\"clase\"][data-id=\"knowledge\"]')?.click();
+      await new Promise(r => setTimeout(r, 300));
+      document.querySelector('.dlgFondo [data-dlg=\"si\"]')?.click();
+      await new Promise(r => setTimeout(r, 1200));
+      const caja = document.querySelector('.dlgFondo');
+      const elegida = !!document.querySelector('.dlgFondo .bvOpcion.elegida[data-id=\"knowledge\"]');
+      const aviso = document.querySelector('#aviso,.aviso,.toast');
+      const fuera = {
+        sigueAbierto: !!caja,
+        elegida,
+        dice: (aviso?.textContent ?? '').trim().slice(0, 80),
+        despues: document.querySelectorAll('.fichaRPG h3').length,
+        antes,
+      };
+      document.dispatchEvent(new KeyboardEvent('keydown', { key: 'Escape', bubbles: true }));
+      await new Promise(r => setTimeout(r, 200));
+      return fuera;
+    })()`);
+    comprueba(
+      'building with no name refuses without closing the form',
+      !!vacia && !vacia.falta && vacia.sigueAbierto === true,
+      JSON.stringify(vacia),
+    );
+    comprueba(
+      'and keeps what was already chosen, and builds nothing',
+      !!vacia?.elegida && vacia?.despues === vacia?.antes,
+      JSON.stringify(vacia),
+    );
+
     // Spanish and English, on a switch. The READMEs shipped bilingual and the
     // product did not; a language button that does not actually change the page
     // is worse than none at all.

package/bin/serve.py

@@ -29,6 +29,7 @@ import stat
 import subprocess
 import sys
 import threading
+import time
 import urllib.parse
 import webbrowser
 
@@ -44,6 +45,7 @@ import parcels  # noqa: E402
 import units  # noqa: E402
 import busca  # noqa: E402  the disk scanner, and the one list of where work lives
 import cities  # noqa: E402
+import diario  # noqa: E402  what happened, written down
 import demos  # noqa: E402  the recorded demos the Hall plays back
 import roads  # noqa: E402
 import reception  # noqa: E402
@@ -523,6 +525,15 @@ def actividad_viva(datos):
         return {"online": False, "url": "", "city": "", "started_at": ""}
 
 
+def _resumen_cuerpo(cuerpo):
+    """On success, the shape rather than the content: which fields arrived and
+    how long each was. A log that repeats every goal somebody types is a log
+    they will not send anywhere."""
+    if not isinstance(cuerpo, dict):
+        return {}
+    return {k: (len(v) if isinstance(v, (str, list)) else v) for k, v in cuerpo.items()}
+
+
 def _que_es_git(ruta):
     """`repo`, `worktree`, or nothing. A label on a row, never a filter: the
     picker shows every folder and lets the person decide which one matters."""
@@ -603,7 +614,27 @@ class Manejador(http.server.BaseHTTPRequestHandler):
         if os.environ.get("CITY_SETUP_DEBUG"):
             sys.stderr.write("  %s\n" % (format % args))
 
+    #: What this handler last answered, so the request log can say so without
+    #: every endpoint having to report for itself.
+    _ultimo = None
+    _error = None
+
+    def apunta(self, q, tipo, **campos):
+        """One journal line, in the journal of the city the request acted on.
+
+        Not the selected one: a request carries `?city=`, and writing its line
+        into whichever city happened to be current put the record of what
+        happened to one city in another city's file. Which is worse than no
+        record, because it is a record that lies about where.
+        """
+        try:
+            diario.apunta(self.ciudad(q), tipo, **campos)
+        except Exception:  # noqa: BLE001  logging must not break the request
+            pass
+
     def responde(self, cuerpo, tipo="application/json", codigo=200):
+        self._ultimo = codigo
+        self._error = cuerpo.get("error") if isinstance(cuerpo, dict) else None
         if not isinstance(cuerpo, bytes):
             cuerpo = json.dumps(cuerpo).encode()
         self.send_response(codigo)
@@ -690,6 +721,7 @@ class Manejador(http.server.BaseHTTPRequestHandler):
         "/api/instrucciones": "g_instrucciones",
         "/api/live": "g_live",
         "/api/carpeta": "g_carpeta",
+        "/api/diario": "g_diario",
         "/api/demos": "g_demos",
         "/api/domains": "g_domains",
         "/api/roles": "g_roles",
@@ -707,6 +739,7 @@ class Manejador(http.server.BaseHTTPRequestHandler):
         "/api/roads": "p_roads",
         "/api/reception": "p_reception",
         "/api/agente": "p_agente",
+        "/api/diario": "p_diario",
         "/api/agentes": "p_agentes",
         "/api/montaje": "p_montaje",
         "/api/motor": "p_motor",
@@ -759,9 +792,24 @@ class Manejador(http.server.BaseHTTPRequestHandler):
             cuerpo = json.loads(self.rfile.read(largo) or b"{}")
         except (ValueError, json.JSONDecodeError) as e:
             return self.responde({"error": f"unreadable body: {e}"}, codigo=400)
-        if ruta in self.POSTS:
-            return getattr(self, self.POSTS[ruta])(q, cuerpo)
-        return self.responde({"error": "no such thing"}, codigo=404)
+        if ruta not in self.POSTS:
+            self.apunta(q, "post", ruta=ruta, estado=404, error="no such thing")
+            return self.responde({"error": "no such thing"}, codigo=404)
+        # Every write is recorded before it happens and judged after, so a
+        # request that never came back says so too — a handler that hangs or
+        # dies leaves a line with no verdict, which is itself the finding.
+        empezado = time.monotonic()
+        self._ultimo = None
+        try:
+            salida = getattr(self, self.POSTS[ruta])(q, cuerpo)
+        except Exception as e:  # noqa: BLE001  the log is the point
+            self.apunta(q, "post", ruta=ruta, error=f"{type(e).__name__}: {e}",
+                        cuerpo=cuerpo, ms=int((time.monotonic() - empezado) * 1000))
+            raise
+        self.apunta(q, "post", ruta=ruta, estado=self._ultimo,
+                    cuerpo=cuerpo if self._ultimo != 200 else _resumen_cuerpo(cuerpo),
+                    error=self._error, ms=int((time.monotonic() - empezado) * 1000))
+        return salida
 
     def g_estado(self, q):
         datos = self.ciudad(q)
@@ -871,6 +919,16 @@ class Manejador(http.server.BaseHTTPRequestHandler):
             return self.responde({"error": "no such demo"}, codigo=404)
         return self.responde({**(demos.ficha(cual, eventos) or {}), "eventos": eventos})
 
+    def g_diario(self, q):
+        """The journal, for `doctor --log` and for anybody about to send it."""
+        try:
+            cuantas = max(1, min(2000, int(q.get("n", ["200"])[0])))
+        except ValueError:
+            cuantas = 200
+        return self.responde(
+            {"ruta": diario.ruta(self.ciudad(q)), "lineas": diario.lee(self.ciudad(q), cuantas)}
+        )
+
     def g_carpeta(self, q):
         """One folder, listed: what is in it, and what each thing is.
 
@@ -1323,8 +1381,23 @@ class Manejador(http.server.BaseHTTPRequestHandler):
             return self.responde({"error": "this city has no owner card yet"}, codigo=409)
         nombre = " ".join(str(cuerpo.get("name") or "").split())
         slug = card.ventana(nombre)
-        if not nombre or not card.ventana_valida(slug):
+        # `card.ventana` falls back to the word `repo` when nothing in the name
+        # survives slugging — which is right for a repository whose folder is
+        # punctuation, and wrong here: a house called `///` would be created
+        # with the window `repo`, and the name a person reads would stop being
+        # the thing the city addresses. A name has to carry a letter or a digit.
+        legible = bool(re.search(r"[a-z0-9]", nombre.lower()))
+        if not nombre or not card.ventana_valida(slug) or not legible:
             return self.responde({"error": "an agent needs a plain name"}, codigo=400)
+        # A window slug is cut at 80 characters, so a longer name would be
+        # stored in full on the card and addressed by a truncated one — the
+        # name a person reads and the window it opens quietly stop being the
+        # same thing. Refuse rather than silently rename.
+        if len(nombre) > 80:
+            return self.responde(
+                {"error": "an agent's name has to fit in a window title: 80 characters"},
+                codigo=400,
+            )
         clase = str(cuerpo.get("kind") or workspace.CLASE_DEFECTO).strip().lower()
         if clase not in workspace.CLASES:
             return self.responde(
@@ -1419,6 +1492,24 @@ class Manejador(http.server.BaseHTTPRequestHandler):
             }
         )
 
+    def p_diario(self, q, cuerpo):
+        """The browser's half of the log.
+
+        Half of what goes wrong here goes wrong in the page — a handler that
+        threw, a fetch that never came back, a button that did nothing. A log
+        that stops at the network boundary tells half the story, so the page
+        writes into the same file the server does, and one file answers "what
+        happened" instead of two that have to be lined up by hand.
+        """
+        diario.apunta(
+            self.ciudad(q),
+            "browser",
+            que=str(cuerpo.get("que") or "")[:120],
+            detalle=cuerpo.get("detalle"),
+            donde=str(cuerpo.get("donde") or "")[:200],
+        )
+        return self.responde({"ok": True})
+
     def p_agente(self, q, cuerpo):
         """Tune one agent from its character sheet: model, effort, runtime and
         avatar seed, written to the card keys the launcher already resolves. An

package/bin/test

@@ -22,7 +22,7 @@ if [ -d .git ] && [ -x .githooks/pre-commit ] \
     && printf '  pre-commit gate armed (core.hooksPath .githooks)\n'
 fi
 
-SUITES=(widgets card parcels domains busca arnes i18n serve seat cities channel connect committee live-feed runtime claude-runtime runtime-ui runtime-failures stress adapter benchmark demo contracts exit rutas cage broker evidencia admision pairing hall-protocol doctor security workspace avatar crecimiento atajos navegador actualiza desinstala launch)
+SUITES=(widgets card parcels domains busca arnes i18n diario serve seat cities channel connect committee live-feed runtime claude-runtime runtime-ui runtime-failures stress adapter benchmark demo contracts exit rutas cage broker evidencia admision pairing hall-protocol doctor security workspace avatar crecimiento atajos navegador actualiza desinstala launch)
 [ $# -gt 0 ] && SUITES=("$@")
 
 fallos=0
@@ -91,6 +91,7 @@ necesarios = ["bin/agents-city.js", "bin/hall", "bin/seat", "bin/city", "bin/dem
               "plugin/scripts/crecimiento.py",
               "plugin/scripts/reset.py", "plugin/scripts/desinstala.py",
               "plugin/scripts/demos.py", "plugin/scripts/arnes.py",
+              "plugin/scripts/diario.py",
               "plugin/channel/runtime/arnes.json", "plugin/scripts/capabilities.py",
               "plugin/scripts/deliberations.py",
               "plugin/scripts/runtime_processes.py",

package/bin/test-diario.py

@@ -0,0 +1,185 @@
+#!/usr/bin/env python3
+"""The journal: what it records, and everything it must survive.
+
+This exists so a failure on somebody else's machine is a file they can send
+rather than a story they have to remember. That promise has two halves, and the
+second is the one with teeth:
+
+  · it records what happened — and
+  · it is safe to attach without reading it first, it never grows without
+    bound, and it can never be the reason a request failed.
+
+A log that breaks the thing it is logging is worse than no log at all, so most
+of what follows is the unhappy path: an unwritable directory, a value that
+cannot be serialised, a line somebody corrupted, a structure with no bottom.
+"""
+
+import os
+import shutil
+import sys
+import tempfile
+
+AQUI = os.path.dirname(os.path.abspath(__file__))
+RAIZ = os.path.dirname(AQUI)
+sys.path.insert(0, AQUI)
+sys.path.insert(0, os.path.join(RAIZ, "plugin", "scripts"))
+
+import cities  # noqa: E402
+import diario  # noqa: E402
+from testlib import afirma, comprueba, resumen  # noqa: E402
+
+
+def ciudad():
+    """A city with an identity, which is what the journal's path is keyed on."""
+    base = tempfile.mkdtemp()
+    datos = os.path.join(base, "home")
+    os.makedirs(datos)
+    with open(os.path.join(datos, "city.yml"), "w", encoding="utf-8") as f:
+        f.write("owner: quien\nname: home\nslug: home\nid: city-diario-prueba\n")
+    return base, datos
+
+
+def lo_que_registra(datos):
+    print("  what it records")
+    diario.apunta(datos, "post", ruta="/api/agentes", estado=400, error="an agent needs a name")
+    diario.apunta(datos, "browser", que="api refused", donde="/api/agentes")
+    lineas = diario.lee(datos)
+    comprueba("· one line per thing that happened", len(lineas), 2)
+    comprueba("· in the order they happened", lineas[0]["tipo"], "post")
+    afirma("· with the moment", bool(lineas[0].get("t")), str(lineas[0]))
+    comprueba("· and the reason a request was refused",
+              lineas[0]["error"], "an agent needs a name")
+    afirma("· the browser's half lands in the same file as the server's",
+           lineas[1]["tipo"] == "browser" and lineas[1]["que"] == "api refused", str(lineas[1]))
+    afirma("· the file is where the runtime keeps this city's things",
+           diario.ruta(datos).endswith("hall.jsonl")
+           and cities.identidad(datos).lower().replace("_", "-")[:20] in diario.ruta(datos).lower(),
+           diario.ruta(datos))
+
+
+def nunca_un_secreto(datos):
+    print("  what it must never record")
+    diario.apunta(
+        datos, "post",
+        PASE="s3cr3t-pase-value", token="tok_abc", Authorization="Bearer xyz",
+        api_key="k", password="p",
+        anidado={"cookie": "c", "inocente": "visible"},
+        suelto="sk-ant-" + "A" * 44,
+    )
+    linea = diario.lee(datos)[-1]
+    for clave in ("PASE", "token", "Authorization", "api_key", "password"):
+        comprueba(f"· {clave} by name", linea.get(clave), "[redacted]")
+    comprueba("· and inside a nested object", linea["anidado"]["cookie"], "[redacted]")
+    comprueba("· while its neighbour survives", linea["anidado"]["inocente"], "visible")
+    afirma("· a value merely SHAPED like a credential goes too",
+           "[redacted]" in linea["suelto"] and "AAAA" not in linea["suelto"], linea["suelto"])
+
+    # The regression that made this worse than useless: a temp directory is a
+    # long run of characters, and redacting it turned a real error message into
+    # `[redacted]` while protecting nothing.
+    for ruta in ("/var/folders/xy/T/tmpab12cd34ef56gh78ij90klmnopqrs/city",
+                 "~/.agents-city/quien/home",
+                 "/Users/alguien/codigo/un-repo-con-nombre-larguisimo-de-verdad"):
+        comprueba(f"· but a path is not a credential: {ruta[:24]}…", diario.limpia(ruta), ruta)
+
+
+def nunca_rompe_la_peticion(datos):
+    print("  what it must survive")
+    # It is called from inside request handlers. Anything it raises becomes a
+    # 500 on a request that had already succeeded.
+    imposible = os.path.join(datos, "no-existe", "ni-va-a-existir")
+    open(os.path.join(datos, "fichero"), "w").close()
+    for roto, como in (
+        (os.path.join(datos, "fichero", "sub"), "a file where a directory should be"),
+        (imposible, "a directory nobody created"),
+    ):
+        try:
+            diario.apunta(roto, "post", ruta="/x")
+            afirma(f"· {como} is survived, not raised", True, "")
+        except Exception as e:  # noqa: BLE001  that is the assertion
+            afirma(f"· {como} is survived, not raised", False, f"{type(e).__name__}: {e}")
+
+    class NoSerializa:
+        pass
+
+    try:
+        diario.apunta(datos, "post", objeto=NoSerializa())
+        afirma("· a value that cannot be written is survived too", True, "")
+    except Exception as e:  # noqa: BLE001
+        afirma("· a value that cannot be written is survived too", False, str(e))
+
+    print("  and what it must not do to itself")
+    hondo = {"a": {}}
+    nodo = hondo["a"]
+    for _ in range(40):
+        nodo["a"] = {}
+        nodo = nodo["a"]
+    diario.apunta(datos, "post", hondo=hondo)
+    afirma("· a structure with no bottom does not recurse forever",
+           len(diario.lee(datos)) > 0, "")
+    diario.apunta(datos, "post", larga="x" * 5000, lista=list(range(500)))
+    linea = diario.lee(datos)[-1]
+    afirma("· a very long string is cut, and says so",
+           len(linea["larga"]) <= 501 and linea["larga"].endswith("…"), str(len(linea["larga"])))
+    afirma("· and a very long list is cut", len(linea["lista"]) <= 40, str(len(linea["lista"])))
+
+
+def se_puede_leer_siempre(datos):
+    print("  and reading it")
+    with open(diario.ruta(datos), "a", encoding="utf-8") as f:
+        f.write("esto no es json\n\n")
+    lineas = diario.lee(datos)
+    afirma("· a corrupted line does not stop the rest being read",
+           any(l.get("tipo") == "unreadable" for l in lineas) and len(lineas) > 1, str(lineas[-2:]))
+    comprueba("· a city with no journal reads as nothing, not as an error",
+              diario.lee(tempfile.mkdtemp()), [])
+
+
+def no_crece_sin_fin(datos):
+    print("  and it does not grow without bound")
+    limite = diario.LIMITE
+    diario.LIMITE = 2000
+    try:
+        for i in range(60):
+            diario.apunta(datos, "post", ruta="/api/x", relleno="y" * 200, i=i)
+        actual = os.path.getsize(diario.ruta(datos))
+        afirma("· it rotates instead of growing", actual < 2000 * 3, str(actual))
+        afirma("· and keeps the previous one, so the rotation is not a hole",
+               os.path.isfile(diario.ruta(datos) + ".1"), "")
+        lineas = diario.lee(datos, 500)
+        afirma("· reading spans the rotation, oldest first",
+               len(lineas) > 20
+               and [l.get("i") for l in lineas if "i" in l]
+               == sorted(l.get("i") for l in lineas if "i" in l),
+               str([l.get("i") for l in lineas][:8]))
+    finally:
+        diario.LIMITE = limite
+
+
+def main():
+    # An app home of its own. Without this the journal's path is derived from
+    # `cities.raiz()`, which is the caller's real `~/.agents-city` — so this
+    # suite wrote into the machine it was running on, and read back somebody
+    # else's lines. A test that touches the real home is worse than a flaky
+    # one: it is a test that changes the thing it is measuring.
+    previo = os.environ.get("AGENTS_CITY_HOME")
+    os.environ["AGENTS_CITY_HOME"] = tempfile.mkdtemp()
+    base, datos = ciudad()
+    try:
+        lo_que_registra(datos)
+        nunca_un_secreto(datos)
+        nunca_rompe_la_peticion(datos)
+        se_puede_leer_siempre(datos)
+        no_crece_sin_fin(datos)
+    finally:
+        shutil.rmtree(os.environ["AGENTS_CITY_HOME"], ignore_errors=True)
+        if previo is None:
+            os.environ.pop("AGENTS_CITY_HOME", None)
+        else:
+            os.environ["AGENTS_CITY_HOME"] = previo
+        shutil.rmtree(base, ignore_errors=True)
+    return resumen("diario")
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/bin/test-navegador.py

@@ -17,6 +17,7 @@ lost its Chrome fails loudly instead of quietly testing nothing.
 """
 
 import hashlib
+import json
 import os
 import shutil
 import subprocess
@@ -201,6 +202,14 @@ def main():
             afirma("· the browser checks ran at all", False, texto.strip()[-500:])
         elif salida.returncode != 0:
             afirma("· the browser driver finished cleanly", False, texto.strip()[-300:])
+        # A browser check that fails says what it saw in the page. What the
+        # SERVER saw is in the city's journal, and printing it here is the
+        # difference between "it did nothing" and the refusal that caused it.
+        if salida.returncode != 0:
+            import diario
+
+            for entrada in diario.lee(datos, 25):
+                print("      journal " + json.dumps(entrada, ensure_ascii=False)[:200])
     finally:
         servidor.shutdown()
         servidor.server_close()

package/bin/test-serve.py

@@ -115,6 +115,78 @@ def prepara_recepcion(hall_datos):
     return city_id, connection_id, road_id, remote_message_id, injection
 
 
+def la_casa_que_no_debe_construirse(puerto, hallDatos):
+    """Every way a house must not be built, and what it must leave behind.
+
+    "I put the name in and it says I did not" was the report, and the server
+    half of that has to be exact: a refusal refuses, says why, leaves the card
+    as it was — a half-written roster is worse than a rejected one — and lands
+    in the journal, because that is what somebody sends when this happens on
+    their machine and not here.
+    """
+    # ── the house that must not be built ────────────────────────────────
+    # "I put the name in and it says I did not" was the report. The server
+    # half of that has to be exact: a refusal must refuse, must say why, and
+    # must leave the card as it was — a half-written roster is worse than a
+    # rejected one. And each refusal must be IN THE JOURNAL, because that is
+    # what somebody sends when it happens on their machine and not here.
+    print("  the house that must not be built")
+    antes = open(os.path.join(hallDatos, "halltest.md"), encoding="utf-8").read()
+    # Every reason this test provoked, so the journal can be checked against
+    # what actually happened rather than against a number somebody guessed.
+    # The count was the wrong assertion: it passed here and failed on Linux,
+    # and said nothing about WHICH refusal had gone missing.
+    provocados = []
+    for nombre, porque in (
+        ("", "no name at all"),
+        ("   ", "a name that is only spaces"),
+        ("///", "a name that survives slugging as nothing"),
+        ("x" * 200, "a name longer than a window can be called"),
+    ):
+        st, cuerpo = pide(puerto, "/api/agentes", metodo="POST",
+                          cuerpo={"name": nombre, "kind": "code", "role": "blank"})
+        comprueba(f"· {porque} is refused", st, 400)
+        motivo = json.loads(cuerpo).get("error", "")
+        afirma(f"· {porque} is refused with a reason a person can read",
+               len(motivo) > 12, cuerpo.decode())
+        provocados.append(motivo)
+    afirma("· and not one of them changed the card",
+           open(os.path.join(hallDatos, "halltest.md"), encoding="utf-8").read() == antes,
+           "a refused agent must leave no trace")
+
+    st, _ = pide(puerto, "/api/agentes", metodo="POST",
+                 cuerpo={"name": "dos veces", "kind": "code", "role": "blank"})
+    comprueba("· a good name is accepted once", st, 200)
+    st, cuerpo = pide(puerto, "/api/agentes", metodo="POST",
+                      cuerpo={"name": "dos veces", "kind": "code", "role": "blank"})
+    comprueba("· and the same name again is a conflict, not a duplicate", st, 409)
+    provocados.append(json.loads(cuerpo).get("error", ""))
+    st, cuerpo = pide(puerto, "/api/agentes", metodo="POST",
+                      cuerpo={"name": "tercera", "kind": "inventada", "role": "blank"})
+    comprueba("· a kind nobody offers is refused", st, 400)
+    provocados.append(json.loads(cuerpo).get("error", ""))
+
+    # Read the journal through the endpoint, not by guessing its path.
+    #
+    # `ciudad({})` falls back to the SELECTED city, and this suite changes which
+    # one that is — it archives one, resets another, creates a third. Computing
+    # the path from `hallDatos` and hoping it matched is how this passed here
+    # and failed on Linux: five refusals in the file it looked at and one in
+    # another. Asking the server resolves the city exactly as the writes did.
+    _st, _cuerpo = pide(puerto, "/api/diario?n=400")
+    anotado = json.loads(_cuerpo)["lineas"]
+    escritos = [l.get("error") for l in anotado
+                if l.get("ruta") == "/api/agentes" and l.get("estado") in (400, 409)]
+    faltan = [m for m in provocados if m not in escritos]
+    afirma("· every refusal this test caused is in the journal, with its reason",
+           not faltan,
+           f"missing from {json.loads(_cuerpo)['ruta']}: {faltan}; journalled: {escritos}")
+    afirma("· and the journal says what was asked for, not just that it failed",
+           any("name" in (l.get("cuerpo") or {}) for l in anotado
+               if l.get("ruta") == "/api/agentes"),
+           str(anotado[-1:]))
+
+
 def main():
     print()
     destino = tempfile.mkdtemp()
@@ -1056,6 +1128,8 @@ def main():
         pide(puerto, "/api/agente", metodo="POST",
              cuerpo={"agent": "notas", "runtime": "", "model": "", "effort": ""})
 
+        la_casa_que_no_debe_construirse(puerto, hallDatos)
+
         # ── the demo shelf ───────────────────────────────────────────────────
         print("  the demos the Hall plays back")
         st, cuerpo = pide(puerto, "/api/demos")

package/city/web/dist-hall/hall.js

@@ -645,11 +645,25 @@ var FormularioDeCasa = class extends Montada {
     try {
       const r = await this.p.api("/api/roles?scope=agent");
       this.roles = r.roles ?? [];
-      if (this.roles.length) this.repinta();
+      this.pintaRoles();
     } catch {
       this.roles = [];
     }
   }
+  /** The role list, once it arrives, without touching anything else. */
+  pintaRoles() {
+    const sel = this.host?.querySelector("#bvRol");
+    if (!sel || !this.roles.length) return;
+    sel.innerHTML = this.opcionesDeRol();
+    sel.value = this.datos.rol;
+    sel.onchange = () => this.recoge();
+    this.recoge();
+  }
+  opcionesDeRol() {
+    return this.roles.map(
+      (r) => `<option value="${this.p.esc(r.id)}"${r.id === this.datos.rol ? " selected" : ""}>${this.p.esc(r.name)}</option>`
+    ).join("");
+  }
   /** The folder picker, built once so walking survives a repaint. */
   explorador = null;
   explora() {
@@ -741,6 +755,12 @@ var FormularioDeCasa = class extends Montada {
     this.enlaza(hueco);
   }
   enlaza(raiz) {
+    raiz.querySelectorAll(
+      "#bvNombre,#bvRol,#bvModelo,#bvEsfuerzo"
+    ).forEach((el) => {
+      el.oninput = () => this.recoge();
+      el.onchange = () => this.recoge();
+    });
     raiz.querySelectorAll("[data-bv]").forEach((el) => {
       el.onclick = (evento) => {
         evento.preventDefault();
@@ -1477,14 +1497,37 @@ function isSpeechEvent(event) {
 // city/web/src/hall.ts
 var PASE = window.PASE;
 var CIUDAD = new URLSearchParams(location.search).get("city") ?? "";
+function anota2(que, detalle, donde) {
+  try {
+    let u = "/api/diario?PASE=" + encodeURIComponent(PASE);
+    if (CIUDAD) u += "&city=" + encodeURIComponent(CIUDAD);
+    void fetch(u, {
+      method: "POST",
+      headers: { "X-City-Pase": PASE, "Content-Type": "application/json" },
+      body: JSON.stringify({ que, detalle, donde: donde ?? location.hash ?? "" }),
+      keepalive: true
+    }).catch(() => {
+    });
+  } catch {
+  }
+}
 async function api(ruta, opts) {
   let u = ruta + (ruta.includes("?") ? "&" : "?") + "PASE=" + encodeURIComponent(PASE);
   if (CIUDAD) u += "&city=" + encodeURIComponent(CIUDAD);
-  const r = await fetch(u, {
-    headers: { "X-City-Pase": PASE, "Content-Type": "application/json" },
-    ...opts
-  });
-  return r.json();
+  let r;
+  try {
+    r = await fetch(u, {
+      headers: { "X-City-Pase": PASE, "Content-Type": "application/json" },
+      ...opts
+    });
+  } catch (e) {
+    if (ruta !== "/api/diario") anota2("fetch failed", String(e), ruta);
+    throw e;
+  }
+  const cuerpo = await r.json();
+  if (ruta !== "/api/diario" && (!r.ok || cuerpo?.error))
+    anota2("api refused", { estado: r.status, error: cuerpo?.error }, ruta);
+  return cuerpo;
 }
 function q(sel, raiz = document) {
   const el = raiz.querySelector(sel);
@@ -3357,6 +3400,14 @@ function interruptorDeIdioma() {
     void refresca();
   };
 }
+window.addEventListener(
+  "error",
+  (e) => anota2("uncaught error", { mensaje: e.message, fichero: e.filename, linea: e.lineno })
+);
+window.addEventListener(
+  "unhandledrejection",
+  (e) => anota2("unhandled rejection", String(e.reason))
+);
 arrastreDelRail();
 interruptorDeIdioma();
 tema();

package/city/web/src/casa.ts

@@ -101,12 +101,38 @@ export class FormularioDeCasa extends Montada {
     try {
       const r = await this.p.api<{ roles: Rol[] }>('/api/roles?scope=agent');
       this.roles = r.roles ?? [];
-      if (this.roles.length) this.repinta();
+      // Only the one control that changed. Rebuilding the whole form because a
+      // dropdown filled in is how the name got lost in the first place, and it
+      // also took the folder picker down mid-walk.
+      this.pintaRoles();
     } catch {
       this.roles = []; // the role list is a convenience; blank is always valid
     }
   }
 
+  /** The role list, once it arrives, without touching anything else. */
+  private pintaRoles(): void {
+    const sel = this.host?.querySelector<HTMLSelectElement>('#bvRol');
+    if (!sel || !this.roles.length) return;
+    sel.innerHTML = this.opcionesDeRol();
+    sel.value = this.datos.rol;
+    // A select that answers to nothing is a select that silently keeps the
+    // first option no matter what the person picks.
+    sel.onchange = () => this.recoge();
+    this.recoge();
+  }
+
+  private opcionesDeRol(): string {
+    return this.roles
+      .map(
+        (r) =>
+          `<option value="${this.p.esc(r.id)}"${
+            r.id === this.datos.rol ? ' selected' : ''
+          }>${this.p.esc(r.name)}</option>`,
+      )
+      .join('');
+  }
+
   /** The folder picker, built once so walking survives a repaint. */
   private explorador: Explorador | null = null;
 
@@ -215,6 +241,25 @@ export class FormularioDeCasa extends Montada {
   }
 
   protected enlaza(raiz: HTMLElement): void {
+    // Every field writes through as it is typed.
+    //
+    // `recoge()` used to be the only sync, called at the moments somebody
+    // remembered to call it — and a repaint from anywhere else redrew the
+    // inputs from a state that had never heard of what was in them. The roles
+    // list arrives a few hundred milliseconds after this form opens, which is
+    // exactly while a person is typing the name: the answer landed, the form
+    // repainted, the name was gone, and then "Build it" said to give it one.
+    //
+    // Now nothing can lose it, because there is no window in which the field
+    // and the state disagree.
+    raiz
+      .querySelectorAll<HTMLInputElement | HTMLSelectElement>(
+        '#bvNombre,#bvRol,#bvModelo,#bvEsfuerzo',
+      )
+      .forEach((el) => {
+        el.oninput = () => this.recoge();
+        el.onchange = () => this.recoge();
+      });
     raiz.querySelectorAll<HTMLElement>('[data-bv]').forEach((el) => {
       el.onclick = (evento) => {
         evento.preventDefault();

package/city/web/src/hall.ts

@@ -279,14 +279,52 @@ declare global {
 const PASE = window.PASE;
 const CIUDAD = new URLSearchParams(location.search).get('city') ?? '';
 
+/**
+ * Tell the city's journal something happened here.
+ *
+ * The page is half of this product and it used to keep its failures to itself:
+ * an error became a toast, the toast went away, and a person reporting it had
+ * only their memory. This writes into the same file the server writes, so one
+ * file answers "what happened" — and `agents-city doctor --report` can hand it
+ * to somebody else without them having to have been watching.
+ *
+ * It never throws and never awaits: a log that can break the thing it is
+ * logging, or slow it down, is worse than no log.
+ */
+function anota(que: string, detalle?: unknown, donde?: string): void {
+  try {
+    let u = '/api/diario?PASE=' + encodeURIComponent(PASE);
+    if (CIUDAD) u += '&city=' + encodeURIComponent(CIUDAD);
+    void fetch(u, {
+      method: 'POST',
+      headers: { 'X-City-Pase': PASE, 'Content-Type': 'application/json' },
+      body: JSON.stringify({ que, detalle, donde: donde ?? location.hash ?? '' }),
+      keepalive: true,
+    }).catch(() => {});
+  } catch {
+    /* the journal is a courtesy, never a dependency */
+  }
+}
+
 async function api<T>(ruta: string, opts?: RequestInit): Promise<T> {
   let u = ruta + (ruta.includes('?') ? '&' : '?') + 'PASE=' + encodeURIComponent(PASE);
   if (CIUDAD) u += '&city=' + encodeURIComponent(CIUDAD);
-  const r = await fetch(u, {
-    headers: { 'X-City-Pase': PASE, 'Content-Type': 'application/json' },
-    ...opts,
-  });
-  return r.json() as Promise<T>;
+  let r: Response;
+  try {
+    r = await fetch(u, {
+      headers: { 'X-City-Pase': PASE, 'Content-Type': 'application/json' },
+      ...opts,
+    });
+  } catch (e) {
+    // A request that never came back. This is the one a person cannot report,
+    // because nothing on screen says it happened.
+    if (ruta !== '/api/diario') anota('fetch failed', String(e), ruta);
+    throw e;
+  }
+  const cuerpo = (await r.json()) as T & { error?: string };
+  if (ruta !== '/api/diario' && (!r.ok || cuerpo?.error))
+    anota('api refused', { estado: r.status, error: cuerpo?.error }, ruta);
+  return cuerpo as T;
 }
 
 /** querySelector that refuses to hand back null: a missing element here is a bug
@@ -2684,6 +2722,15 @@ function interruptorDeIdioma(): void {
   };
 }
 
+// Nothing in a browser reports itself. These two are why a person can say "it
+// just did nothing" and be exactly right.
+window.addEventListener('error', (e) =>
+  anota('uncaught error', { mensaje: e.message, fichero: e.filename, linea: e.lineno }),
+);
+window.addEventListener('unhandledrejection', (e) =>
+  anota('unhandled rejection', String((e as PromiseRejectionEvent).reason)),
+);
+
 arrastreDelRail();
 interruptorDeIdioma();
 tema();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agents-city",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "description": "Run autonomous agent cities: one chair seat, role-aware repo agents, repo-owned skills, and explicit roads.",
   "bin": {
     "agents-city": "bin/agents-city.js"

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "city",
   "displayName": "Agents City",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "description": "One autonomous city seat with a work domain, role, goal, repo support agents, recognised skills and explicit roads to other cities.",
   "author": {
     "name": "jlcases",

package/plugin/scripts/diario.py

@@ -0,0 +1,119 @@
+#!/usr/bin/env python3
+"""What happened, written down, so a failure on somebody else's machine is not a
+story they have to remember.
+
+The Hall had no log at all. It answered the browser with an error, the browser
+put a toast on screen, the toast went away, and there was nothing left. When
+somebody said "it says the name is empty and the name is right there", the only
+honest answer was "reproduce it for me" — which is asking a person to debug
+their own bug report.
+
+So: one file, always written, per city.
+
+    ~/.agents-city/.runtime/bus/<city>/hall.jsonl
+
+One JSON object per line, oldest first. The browser writes into the same file
+as the server, because half of these failures happen in the browser and a log
+that stops at the network boundary tells half a story.
+
+Two things it must never do. It must not grow without bound — it rotates at two
+megabytes and keeps one previous file, which is enough to see what happened and
+not enough to matter. And it must not record a secret: `agents-city doctor
+--report` exists so somebody can send this to a stranger, and a log that has to
+be read before it is sent is a log nobody sends.
+"""
+
+import json
+import os
+import re
+import time
+
+#: Rotate here. Small enough that the file is readable, large enough to hold a
+#: session's worth of a person clicking around.
+LIMITE = 2 * 1024 * 1024
+
+#: Anything whose NAME says it is a credential. Matched on the key, because the
+#: value of a token looks like the value of an id.
+SECRETO = re.compile(
+    r"pase|token|secret|password|passwd|authorization|cookie|api[_-]?key|credential",
+    re.I,
+)
+
+#: And anything shaped like one wherever it turns up: a long unbroken run of
+#: hex or base64. Slashes are NOT part of it — a temp directory is a long run
+#: of characters with slashes in it, and redacting `/var/folders/...` turned a
+#: useful error message into `[redacted]` while protecting nothing.
+PARECE_CLAVE = re.compile(r"(?<![\w./-])[A-Za-z0-9+_-]{32,}={0,2}(?![\w./-])")
+
+
+def ruta(datos):
+    import runtime_processes
+
+    return os.path.join(runtime_processes.ruta(datos), "hall.jsonl")
+
+
+def limpia(valor, profundidad=0):
+    """The same value with anything that looks like a credential taken out.
+
+    Applied on the way IN, not on the way out: a secret that reaches the file
+    has already been written to somebody's disk, and the promise this makes is
+    that the file is safe to attach to an issue without reading it first.
+    """
+    if profundidad > 6:
+        return "…"
+    if isinstance(valor, dict):
+        return {
+            k: ("[redacted]" if SECRETO.search(str(k)) else limpia(v, profundidad + 1))
+            for k, v in list(valor.items())[:40]
+        }
+    if isinstance(valor, (list, tuple)):
+        return [limpia(v, profundidad + 1) for v in valor[:40]]
+    if isinstance(valor, str):
+        recortado = valor if len(valor) <= 500 else valor[:497] + "…"
+        return PARECE_CLAVE.sub("[redacted]", recortado)
+    return valor
+
+
+def _rota(fichero):
+    try:
+        if os.path.getsize(fichero) < LIMITE:
+            return
+    except OSError:
+        return
+    try:
+        os.replace(fichero, fichero + ".1")
+    except OSError:
+        pass
+
+
+def apunta(datos, tipo, **campos):
+    """One line. Never raises: a log that can break the thing it is logging is
+    worse than no log, and this is called from inside request handlers."""
+    try:
+        fichero = ruta(datos)
+        os.makedirs(os.path.dirname(fichero), exist_ok=True)
+        _rota(fichero)
+        linea = {"t": time.strftime("%Y-%m-%dT%H:%M:%S"), "tipo": tipo}
+        linea.update(limpia(campos))
+        with open(fichero, "a", encoding="utf-8") as f:
+            f.write(json.dumps(linea, ensure_ascii=False) + "\n")
+    except (OSError, TypeError, ValueError):
+        pass
+
+
+def lee(datos, cuantas=200):
+    """The last `cuantas` entries, oldest first, across the rotation."""
+    fuera = []
+    for fichero in (ruta(datos) + ".1", ruta(datos)):
+        try:
+            with open(fichero, encoding="utf-8") as f:
+                fuera.extend(l.strip() for l in f if l.strip())
+        except OSError:
+            continue
+    salida = []
+    for linea in fuera[-cuantas:]:
+        try:
+            salida.append(json.loads(linea))
+        except json.JSONDecodeError:
+            salida.append({"tipo": "unreadable", "linea": linea[:200]})
+    return salida

package/plugin/scripts/doctor.py

@@ -266,6 +266,56 @@ def informe_entorno():
     return 1 if roto else 0
 
 
+def _diario(empaqueta, resto):
+    """`doctor --log` reads the journal; `doctor --report` bundles it to send.
+
+    The report is the thing that was missing. When this breaks on somebody
+    else's machine, the useful answer is not "tell me what you did" — it is a
+    file they can attach without reading it first. So it carries the journal and
+    the environment report, and nothing else: `diario` redacts credentials on
+    the way in, so what lands here was never a secret to begin with.
+    """
+    import cities  # noqa: PLC0415
+    import diario  # noqa: PLC0415
+
+    datos = cities.actual()
+    try:
+        cuantas = int(resto[0]) if resto else (2000 if empaqueta else 60)
+    except ValueError:
+        cuantas = 60
+    lineas = diario.lee(datos, cuantas)
+    if not empaqueta:
+        print(f'\n  {diario.ruta(datos)}\n')
+        if not lineas:
+            print('  Nothing recorded yet. The Hall writes here as you use it.\n')
+            return 0
+        for l in lineas:
+            resto_l = {k: v for k, v in l.items() if k not in ('t', 'tipo')}
+            detalle = json.dumps(resto_l, ensure_ascii=False)[:160]
+            print(f"  {l.get('t', '')}  {l.get('tipo', ''):8} {detalle}")
+        print()
+        return 0
+
+    import io  # noqa: PLC0415
+    from contextlib import redirect_stdout  # noqa: PLC0415
+
+    entorno = io.StringIO()
+    with redirect_stdout(entorno):
+        informe_entorno()
+    destino = os.path.join(os.path.expanduser('~'), 'agents-city-report.txt')
+    with open(destino, 'w', encoding='utf-8') as f:
+        f.write('# agents-city report\n\n')
+        f.write('## this machine\n')
+        f.write(entorno.getvalue())
+        f.write(f'\n## the journal ({len(lineas)} entries)\n\n')
+        for l in lineas:
+            f.write(json.dumps(l, ensure_ascii=False) + '\n')
+    print(f'\n  Written to {destino}\n')
+    print('  It holds what this machine is and what the town hall did.')
+    print('  Credentials are stripped as they are recorded, so it is safe to attach.\n')
+    return 0
+
+
 def main(argv=None):
     # The arguments are a parameter so this door can be knocked on from a test
     # without a subprocess: `doctor --config` is the command that backs a claim
@@ -290,6 +340,9 @@ def main(argv=None):
     # can be checked instead of believed.
     if argv[1] in ('--config', 'config'):
         return arnes.main(argv[2:])
+    # What happened, and something to attach to an issue.
+    if argv[1] in ('--log', 'log', '--report', 'report'):
+        return _diario(argv[1] in ('--report', 'report'), argv[2:])
     p = argparse.ArgumentParser(description='Detect, explain and migrate an old config shape.')
     p.add_argument('fichero', help='the config JSON file to check')
     p.add_argument('--fix', action='store_true', help='rewrite (default is dry-run report)')