agents-city 0.5.1 → 0.5.3

package/bin/test-diario.py

@@ -0,0 +1,185 @@
+#!/usr/bin/env python3
+"""The journal: what it records, and everything it must survive.
+
+This exists so a failure on somebody else's machine is a file they can send
+rather than a story they have to remember. That promise has two halves, and the
+second is the one with teeth:
+
+  · it records what happened — and
+  · it is safe to attach without reading it first, it never grows without
+    bound, and it can never be the reason a request failed.
+
+A log that breaks the thing it is logging is worse than no log at all, so most
+of what follows is the unhappy path: an unwritable directory, a value that
+cannot be serialised, a line somebody corrupted, a structure with no bottom.
+"""
+
+import os
+import shutil
+import sys
+import tempfile
+
+AQUI = os.path.dirname(os.path.abspath(__file__))
+RAIZ = os.path.dirname(AQUI)
+sys.path.insert(0, AQUI)
+sys.path.insert(0, os.path.join(RAIZ, "plugin", "scripts"))
+
+import cities  # noqa: E402
+import diario  # noqa: E402
+from testlib import afirma, comprueba, resumen  # noqa: E402
+
+
+def ciudad():
+    """A city with an identity, which is what the journal's path is keyed on."""
+    base = tempfile.mkdtemp()
+    datos = os.path.join(base, "home")
+    os.makedirs(datos)
+    with open(os.path.join(datos, "city.yml"), "w", encoding="utf-8") as f:
+        f.write("owner: quien\nname: home\nslug: home\nid: city-diario-prueba\n")
+    return base, datos
+
+
+def lo_que_registra(datos):
+    print("  what it records")
+    diario.apunta(datos, "post", ruta="/api/agentes", estado=400, error="an agent needs a name")
+    diario.apunta(datos, "browser", que="api refused", donde="/api/agentes")
+    lineas = diario.lee(datos)
+    comprueba("· one line per thing that happened", len(lineas), 2)
+    comprueba("· in the order they happened", lineas[0]["tipo"], "post")
+    afirma("· with the moment", bool(lineas[0].get("t")), str(lineas[0]))
+    comprueba("· and the reason a request was refused",
+              lineas[0]["error"], "an agent needs a name")
+    afirma("· the browser's half lands in the same file as the server's",
+           lineas[1]["tipo"] == "browser" and lineas[1]["que"] == "api refused", str(lineas[1]))
+    afirma("· the file is where the runtime keeps this city's things",
+           diario.ruta(datos).endswith("hall.jsonl")
+           and cities.identidad(datos).lower().replace("_", "-")[:20] in diario.ruta(datos).lower(),
+           diario.ruta(datos))
+
+
+def nunca_un_secreto(datos):
+    print("  what it must never record")
+    diario.apunta(
+        datos, "post",
+        PASE="s3cr3t-pase-value", token="tok_abc", Authorization="Bearer xyz",
+        api_key="k", password="p",
+        anidado={"cookie": "c", "inocente": "visible"},
+        suelto="sk-ant-" + "A" * 44,
+    )
+    linea = diario.lee(datos)[-1]
+    for clave in ("PASE", "token", "Authorization", "api_key", "password"):
+        comprueba(f"· {clave} by name", linea.get(clave), "[redacted]")
+    comprueba("· and inside a nested object", linea["anidado"]["cookie"], "[redacted]")
+    comprueba("· while its neighbour survives", linea["anidado"]["inocente"], "visible")
+    afirma("· a value merely SHAPED like a credential goes too",
+           "[redacted]" in linea["suelto"] and "AAAA" not in linea["suelto"], linea["suelto"])
+
+    # The regression that made this worse than useless: a temp directory is a
+    # long run of characters, and redacting it turned a real error message into
+    # `[redacted]` while protecting nothing.
+    for ruta in ("/var/folders/xy/T/tmpab12cd34ef56gh78ij90klmnopqrs/city",
+                 "~/.agents-city/quien/home",
+                 "/Users/alguien/codigo/un-repo-con-nombre-larguisimo-de-verdad"):
+        comprueba(f"· but a path is not a credential: {ruta[:24]}…", diario.limpia(ruta), ruta)
+
+
+def nunca_rompe_la_peticion(datos):
+    print("  what it must survive")
+    # It is called from inside request handlers. Anything it raises becomes a
+    # 500 on a request that had already succeeded.
+    imposible = os.path.join(datos, "no-existe", "ni-va-a-existir")
+    open(os.path.join(datos, "fichero"), "w").close()
+    for roto, como in (
+        (os.path.join(datos, "fichero", "sub"), "a file where a directory should be"),
+        (imposible, "a directory nobody created"),
+    ):
+        try:
+            diario.apunta(roto, "post", ruta="/x")
+            afirma(f"· {como} is survived, not raised", True, "")
+        except Exception as e:  # noqa: BLE001  that is the assertion
+            afirma(f"· {como} is survived, not raised", False, f"{type(e).__name__}: {e}")
+
+    class NoSerializa:
+        pass
+
+    try:
+        diario.apunta(datos, "post", objeto=NoSerializa())
+        afirma("· a value that cannot be written is survived too", True, "")
+    except Exception as e:  # noqa: BLE001
+        afirma("· a value that cannot be written is survived too", False, str(e))
+
+    print("  and what it must not do to itself")
+    hondo = {"a": {}}
+    nodo = hondo["a"]
+    for _ in range(40):
+        nodo["a"] = {}
+        nodo = nodo["a"]
+    diario.apunta(datos, "post", hondo=hondo)
+    afirma("· a structure with no bottom does not recurse forever",
+           len(diario.lee(datos)) > 0, "")
+    diario.apunta(datos, "post", larga="x" * 5000, lista=list(range(500)))
+    linea = diario.lee(datos)[-1]
+    afirma("· a very long string is cut, and says so",
+           len(linea["larga"]) <= 501 and linea["larga"].endswith("…"), str(len(linea["larga"])))
+    afirma("· and a very long list is cut", len(linea["lista"]) <= 40, str(len(linea["lista"])))
+
+
+def se_puede_leer_siempre(datos):
+    print("  and reading it")
+    with open(diario.ruta(datos), "a", encoding="utf-8") as f:
+        f.write("esto no es json\n\n")
+    lineas = diario.lee(datos)
+    afirma("· a corrupted line does not stop the rest being read",
+           any(l.get("tipo") == "unreadable" for l in lineas) and len(lineas) > 1, str(lineas[-2:]))
+    comprueba("· a city with no journal reads as nothing, not as an error",
+              diario.lee(tempfile.mkdtemp()), [])
+
+
+def no_crece_sin_fin(datos):
+    print("  and it does not grow without bound")
+    limite = diario.LIMITE
+    diario.LIMITE = 2000
+    try:
+        for i in range(60):
+            diario.apunta(datos, "post", ruta="/api/x", relleno="y" * 200, i=i)
+        actual = os.path.getsize(diario.ruta(datos))
+        afirma("· it rotates instead of growing", actual < 2000 * 3, str(actual))
+        afirma("· and keeps the previous one, so the rotation is not a hole",
+               os.path.isfile(diario.ruta(datos) + ".1"), "")
+        lineas = diario.lee(datos, 500)
+        afirma("· reading spans the rotation, oldest first",
+               len(lineas) > 20
+               and [l.get("i") for l in lineas if "i" in l]
+               == sorted(l.get("i") for l in lineas if "i" in l),
+               str([l.get("i") for l in lineas][:8]))
+    finally:
+        diario.LIMITE = limite
+
+
+def main():
+    # An app home of its own. Without this the journal's path is derived from
+    # `cities.raiz()`, which is the caller's real `~/.agents-city` — so this
+    # suite wrote into the machine it was running on, and read back somebody
+    # else's lines. A test that touches the real home is worse than a flaky
+    # one: it is a test that changes the thing it is measuring.
+    previo = os.environ.get("AGENTS_CITY_HOME")
+    os.environ["AGENTS_CITY_HOME"] = tempfile.mkdtemp()
+    base, datos = ciudad()
+    try:
+        lo_que_registra(datos)
+        nunca_un_secreto(datos)
+        nunca_rompe_la_peticion(datos)
+        se_puede_leer_siempre(datos)
+        no_crece_sin_fin(datos)
+    finally:
+        shutil.rmtree(os.environ["AGENTS_CITY_HOME"], ignore_errors=True)
+        if previo is None:
+            os.environ.pop("AGENTS_CITY_HOME", None)
+        else:
+            os.environ["AGENTS_CITY_HOME"] = previo
+        shutil.rmtree(base, ignore_errors=True)
+    return resumen("diario")
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/bin/test-navegador.py

@@ -17,6 +17,7 @@ lost its Chrome fails loudly instead of quietly testing nothing.
 """
 
 import hashlib
+import json
 import os
 import shutil
 import subprocess
@@ -201,6 +202,14 @@ def main():
             afirma("· the browser checks ran at all", False, texto.strip()[-500:])
         elif salida.returncode != 0:
             afirma("· the browser driver finished cleanly", False, texto.strip()[-300:])
+        # A browser check that fails says what it saw in the page. What the
+        # SERVER saw is in the city's journal, and printing it here is the
+        # difference between "it did nothing" and the refusal that caused it.
+        if salida.returncode != 0:
+            import diario
+
+            for entrada in diario.lee(datos, 25):
+                print("      journal " + json.dumps(entrada, ensure_ascii=False)[:200])
     finally:
         servidor.shutdown()
         servidor.server_close()

package/bin/test-seat.py

@@ -1101,6 +1101,56 @@ def motores_del_puesto():
             )
 
 
+def el_settings_sobrevive_a_la_shell(asiento, api):
+    """The launch line, parsed the way a shell parses it.
+
+    Asserting the words appear somewhere in the string is not enough, and the
+    gap cost every Claude window in a city: `--settings {"a":"b","c":true}`
+    emitted without quotes is split by brace expansion on the comma and
+    stripped of its double quotes, so what reached Claude was `{a:b}` and it
+    exited with "Invalid JSON provided to --settings". The string contained
+    every word a substring check looks for.
+    """
+    import shlex
+
+    def ajustes_de(linea):
+        """The `--settings` value, dug out through however many shells wrap it.
+
+        A repo window is launched through `tmux send-keys`, so its whole command
+        is one quoted word inside the line; the chair's is not. Splitting once
+        and giving up would test the chair and quietly skip the houses — which
+        is exactly the window that broke.
+        """
+        pendientes, visto = [linea], 0
+        while pendientes and visto < 6:
+            visto += 1
+            actual = pendientes.pop(0)
+            try:
+                palabras = shlex.split(actual)
+            except ValueError:
+                continue
+            if "--settings" in palabras:
+                return palabras[palabras.index("--settings") + 1]
+            pendientes.extend(x for x in palabras if "--settings" in x and x != actual)
+        return None
+
+    for etiqueta, linea in (("the chair", asiento), ("an agent house", api)):
+        crudo = ajustes_de(linea)
+        if crudo is None:
+            afirma(f"· {etiqueta} is launched with --settings", False, linea[:250])
+            continue
+        try:
+            ajustes = json.loads(crudo)
+        except json.JSONDecodeError as e:
+            afirma(f"· {etiqueta}'s --settings is still JSON after the shell has it",
+                   False, f"{crudo!r}: {e}")
+            continue
+        afirma(f"· {etiqueta}'s --settings is still JSON after the shell has it",
+               isinstance(ajustes, dict), crudo)
+        comprueba(f"· and {etiqueta} still refuses cross-session inbound",
+                  ajustes.get("crossSessionInbound"), "refuse")
+
+
 def arranque_escalonado():
     """Claude windows must not all start in the same millisecond.
 
@@ -1310,6 +1360,8 @@ def arranque_escalonado():
         "CITY_BUS_URL= CITY_BUS_TOKEN=" in api and "CITY_BUS_URL= CITY_BUS_TOKEN=" in docs,
     )
     claude_contract = (asiento + "\n" + api).replace("\\", "")
+    el_settings_sobrevive_a_la_shell(asiento, api)
+
     afirma(
         "· Claude native peer messaging is refused and its tools denied",
         claude_contract.count("crossSessionInbound") == 2

package/bin/test-serve.py

@@ -115,6 +115,78 @@ def prepara_recepcion(hall_datos):
     return city_id, connection_id, road_id, remote_message_id, injection
 
 
+def la_casa_que_no_debe_construirse(puerto, hallDatos):
+    """Every way a house must not be built, and what it must leave behind.
+
+    "I put the name in and it says I did not" was the report, and the server
+    half of that has to be exact: a refusal refuses, says why, leaves the card
+    as it was — a half-written roster is worse than a rejected one — and lands
+    in the journal, because that is what somebody sends when this happens on
+    their machine and not here.
+    """
+    # ── the house that must not be built ────────────────────────────────
+    # "I put the name in and it says I did not" was the report. The server
+    # half of that has to be exact: a refusal must refuse, must say why, and
+    # must leave the card as it was — a half-written roster is worse than a
+    # rejected one. And each refusal must be IN THE JOURNAL, because that is
+    # what somebody sends when it happens on their machine and not here.
+    print("  the house that must not be built")
+    antes = open(os.path.join(hallDatos, "halltest.md"), encoding="utf-8").read()
+    # Every reason this test provoked, so the journal can be checked against
+    # what actually happened rather than against a number somebody guessed.
+    # The count was the wrong assertion: it passed here and failed on Linux,
+    # and said nothing about WHICH refusal had gone missing.
+    provocados = []
+    for nombre, porque in (
+        ("", "no name at all"),
+        ("   ", "a name that is only spaces"),
+        ("///", "a name that survives slugging as nothing"),
+        ("x" * 200, "a name longer than a window can be called"),
+    ):
+        st, cuerpo = pide(puerto, "/api/agentes", metodo="POST",
+                          cuerpo={"name": nombre, "kind": "code", "role": "blank"})
+        comprueba(f"· {porque} is refused", st, 400)
+        motivo = json.loads(cuerpo).get("error", "")
+        afirma(f"· {porque} is refused with a reason a person can read",
+               len(motivo) > 12, cuerpo.decode())
+        provocados.append(motivo)
+    afirma("· and not one of them changed the card",
+           open(os.path.join(hallDatos, "halltest.md"), encoding="utf-8").read() == antes,
+           "a refused agent must leave no trace")
+
+    st, _ = pide(puerto, "/api/agentes", metodo="POST",
+                 cuerpo={"name": "dos veces", "kind": "code", "role": "blank"})
+    comprueba("· a good name is accepted once", st, 200)
+    st, cuerpo = pide(puerto, "/api/agentes", metodo="POST",
+                      cuerpo={"name": "dos veces", "kind": "code", "role": "blank"})
+    comprueba("· and the same name again is a conflict, not a duplicate", st, 409)
+    provocados.append(json.loads(cuerpo).get("error", ""))
+    st, cuerpo = pide(puerto, "/api/agentes", metodo="POST",
+                      cuerpo={"name": "tercera", "kind": "inventada", "role": "blank"})
+    comprueba("· a kind nobody offers is refused", st, 400)
+    provocados.append(json.loads(cuerpo).get("error", ""))
+
+    # Read the journal through the endpoint, not by guessing its path.
+    #
+    # `ciudad({})` falls back to the SELECTED city, and this suite changes which
+    # one that is — it archives one, resets another, creates a third. Computing
+    # the path from `hallDatos` and hoping it matched is how this passed here
+    # and failed on Linux: five refusals in the file it looked at and one in
+    # another. Asking the server resolves the city exactly as the writes did.
+    _st, _cuerpo = pide(puerto, "/api/diario?n=400")
+    anotado = json.loads(_cuerpo)["lineas"]
+    escritos = [l.get("error") for l in anotado
+                if l.get("ruta") == "/api/agentes" and l.get("estado") in (400, 409)]
+    faltan = [m for m in provocados if m not in escritos]
+    afirma("· every refusal this test caused is in the journal, with its reason",
+           not faltan,
+           f"missing from {json.loads(_cuerpo)['ruta']}: {faltan}; journalled: {escritos}")
+    afirma("· and the journal says what was asked for, not just that it failed",
+           any("name" in (l.get("cuerpo") or {}) for l in anotado
+               if l.get("ruta") == "/api/agentes"),
+           str(anotado[-1:]))
+
+
 def main():
     print()
     destino = tempfile.mkdtemp()
@@ -865,7 +937,31 @@ def main():
             not os.path.exists(os.path.join(hallDatos, "units.yml"))
             or "u1" not in open(os.path.join(hallDatos, "units.yml")).read(),
         )
+        # Observing must not create.
+        #
+        # The journal runs after the handler, and it used to resolve its city
+        # through `ciudad`, which does `makedirs` and writes `city.yml`. On a
+        # request that archived a city, the log line recreated the folder that
+        # had just been taken away — a ghost city, left behind by the act of
+        # recording that it had gone. It also raced this very cleanup.
         shutil.rmtree(otra)
+        # The resolver the journal uses, on its own: it must answer where
+        # to write without bringing anything into being.
+        #
+        # (A handler is a different matter. It resolves through `ciudad`, which
+        # creates metadata for a city it is about to act on, so a request naming
+        # a deleted city can recreate its folder. That predates the journal and
+        # is not what this is about.)
+        fantasma = os.path.join(tempfile.mkdtemp(), "no-existe")
+        manejador = serve.Manejador.__new__(serve.Manejador)
+        donde = manejador._ciudad_para_apuntar(
+            {"city": [fantasma]}
+        )
+        afirma(
+            "· the journal's own resolver creates nothing",
+            not os.path.exists(fantasma) and isinstance(donde, str),
+            f"{fantasma} exists after only asking where to log",
+        )
 
         # ── the demo's remote control ────────────────────────────────────────
         print("  the demo's remote control")
@@ -1056,6 +1152,8 @@ def main():
         pide(puerto, "/api/agente", metodo="POST",
              cuerpo={"agent": "notas", "runtime": "", "model": "", "effort": ""})
 
+        la_casa_que_no_debe_construirse(puerto, hallDatos)
+
         # ── the demo shelf ───────────────────────────────────────────────────
         print("  the demos the Hall plays back")
         st, cuerpo = pide(puerto, "/api/demos")

package/city/web/dist-hall/hall.js

@@ -645,11 +645,25 @@ var FormularioDeCasa = class extends Montada {
     try {
       const r = await this.p.api("/api/roles?scope=agent");
       this.roles = r.roles ?? [];
-      if (this.roles.length) this.repinta();
+      this.pintaRoles();
     } catch {
       this.roles = [];
     }
   }
+  /** The role list, once it arrives, without touching anything else. */
+  pintaRoles() {
+    const sel = this.host?.querySelector("#bvRol");
+    if (!sel || !this.roles.length) return;
+    sel.innerHTML = this.opcionesDeRol();
+    sel.value = this.datos.rol;
+    sel.onchange = () => this.recoge();
+    this.recoge();
+  }
+  opcionesDeRol() {
+    return this.roles.map(
+      (r) => `<option value="${this.p.esc(r.id)}"${r.id === this.datos.rol ? " selected" : ""}>${this.p.esc(r.name)}</option>`
+    ).join("");
+  }
   /** The folder picker, built once so walking survives a repaint. */
   explorador = null;
   explora() {
@@ -741,6 +755,12 @@ var FormularioDeCasa = class extends Montada {
     this.enlaza(hueco);
   }
   enlaza(raiz) {
+    raiz.querySelectorAll(
+      "#bvNombre,#bvRol,#bvModelo,#bvEsfuerzo"
+    ).forEach((el) => {
+      el.oninput = () => this.recoge();
+      el.onchange = () => this.recoge();
+    });
     raiz.querySelectorAll("[data-bv]").forEach((el) => {
       el.onclick = (evento) => {
         evento.preventDefault();
@@ -1477,14 +1497,37 @@ function isSpeechEvent(event) {
 // city/web/src/hall.ts
 var PASE = window.PASE;
 var CIUDAD = new URLSearchParams(location.search).get("city") ?? "";
+function anota2(que, detalle, donde) {
+  try {
+    let u = "/api/diario?PASE=" + encodeURIComponent(PASE);
+    if (CIUDAD) u += "&city=" + encodeURIComponent(CIUDAD);
+    void fetch(u, {
+      method: "POST",
+      headers: { "X-City-Pase": PASE, "Content-Type": "application/json" },
+      body: JSON.stringify({ que, detalle, donde: donde ?? location.hash ?? "" }),
+      keepalive: true
+    }).catch(() => {
+    });
+  } catch {
+  }
+}
 async function api(ruta, opts) {
   let u = ruta + (ruta.includes("?") ? "&" : "?") + "PASE=" + encodeURIComponent(PASE);
   if (CIUDAD) u += "&city=" + encodeURIComponent(CIUDAD);
-  const r = await fetch(u, {
-    headers: { "X-City-Pase": PASE, "Content-Type": "application/json" },
-    ...opts
-  });
-  return r.json();
+  let r;
+  try {
+    r = await fetch(u, {
+      headers: { "X-City-Pase": PASE, "Content-Type": "application/json" },
+      ...opts
+    });
+  } catch (e) {
+    if (ruta !== "/api/diario") anota2("fetch failed", String(e), ruta);
+    throw e;
+  }
+  const cuerpo = await r.json();
+  if (ruta !== "/api/diario" && (!r.ok || cuerpo?.error))
+    anota2("api refused", { estado: r.status, error: cuerpo?.error }, ruta);
+  return cuerpo;
 }
 function q(sel, raiz = document) {
   const el = raiz.querySelector(sel);
@@ -3357,6 +3400,14 @@ function interruptorDeIdioma() {
     void refresca();
   };
 }
+window.addEventListener(
+  "error",
+  (e) => anota2("uncaught error", { mensaje: e.message, fichero: e.filename, linea: e.lineno })
+);
+window.addEventListener(
+  "unhandledrejection",
+  (e) => anota2("unhandled rejection", String(e.reason))
+);
 arrastreDelRail();
 interruptorDeIdioma();
 tema();

package/city/web/src/casa.ts

@@ -101,12 +101,38 @@ export class FormularioDeCasa extends Montada {
     try {
       const r = await this.p.api<{ roles: Rol[] }>('/api/roles?scope=agent');
       this.roles = r.roles ?? [];
-      if (this.roles.length) this.repinta();
+      // Only the one control that changed. Rebuilding the whole form because a
+      // dropdown filled in is how the name got lost in the first place, and it
+      // also took the folder picker down mid-walk.
+      this.pintaRoles();
     } catch {
       this.roles = []; // the role list is a convenience; blank is always valid
     }
   }
 
+  /** The role list, once it arrives, without touching anything else. */
+  private pintaRoles(): void {
+    const sel = this.host?.querySelector<HTMLSelectElement>('#bvRol');
+    if (!sel || !this.roles.length) return;
+    sel.innerHTML = this.opcionesDeRol();
+    sel.value = this.datos.rol;
+    // A select that answers to nothing is a select that silently keeps the
+    // first option no matter what the person picks.
+    sel.onchange = () => this.recoge();
+    this.recoge();
+  }
+
+  private opcionesDeRol(): string {
+    return this.roles
+      .map(
+        (r) =>
+          `<option value="${this.p.esc(r.id)}"${
+            r.id === this.datos.rol ? ' selected' : ''
+          }>${this.p.esc(r.name)}</option>`,
+      )
+      .join('');
+  }
+
   /** The folder picker, built once so walking survives a repaint. */
   private explorador: Explorador | null = null;
 
@@ -215,6 +241,25 @@ export class FormularioDeCasa extends Montada {
   }
 
   protected enlaza(raiz: HTMLElement): void {
+    // Every field writes through as it is typed.
+    //
+    // `recoge()` used to be the only sync, called at the moments somebody
+    // remembered to call it — and a repaint from anywhere else redrew the
+    // inputs from a state that had never heard of what was in them. The roles
+    // list arrives a few hundred milliseconds after this form opens, which is
+    // exactly while a person is typing the name: the answer landed, the form
+    // repainted, the name was gone, and then "Build it" said to give it one.
+    //
+    // Now nothing can lose it, because there is no window in which the field
+    // and the state disagree.
+    raiz
+      .querySelectorAll<HTMLInputElement | HTMLSelectElement>(
+        '#bvNombre,#bvRol,#bvModelo,#bvEsfuerzo',
+      )
+      .forEach((el) => {
+        el.oninput = () => this.recoge();
+        el.onchange = () => this.recoge();
+      });
     raiz.querySelectorAll<HTMLElement>('[data-bv]').forEach((el) => {
       el.onclick = (evento) => {
         evento.preventDefault();

package/city/web/src/hall.ts

@@ -279,14 +279,52 @@ declare global {
 const PASE = window.PASE;
 const CIUDAD = new URLSearchParams(location.search).get('city') ?? '';
 
+/**
+ * Tell the city's journal something happened here.
+ *
+ * The page is half of this product and it used to keep its failures to itself:
+ * an error became a toast, the toast went away, and a person reporting it had
+ * only their memory. This writes into the same file the server writes, so one
+ * file answers "what happened" — and `agents-city doctor --report` can hand it
+ * to somebody else without them having to have been watching.
+ *
+ * It never throws and never awaits: a log that can break the thing it is
+ * logging, or slow it down, is worse than no log.
+ */
+function anota(que: string, detalle?: unknown, donde?: string): void {
+  try {
+    let u = '/api/diario?PASE=' + encodeURIComponent(PASE);
+    if (CIUDAD) u += '&city=' + encodeURIComponent(CIUDAD);
+    void fetch(u, {
+      method: 'POST',
+      headers: { 'X-City-Pase': PASE, 'Content-Type': 'application/json' },
+      body: JSON.stringify({ que, detalle, donde: donde ?? location.hash ?? '' }),
+      keepalive: true,
+    }).catch(() => {});
+  } catch {
+    /* the journal is a courtesy, never a dependency */
+  }
+}
+
 async function api<T>(ruta: string, opts?: RequestInit): Promise<T> {
   let u = ruta + (ruta.includes('?') ? '&' : '?') + 'PASE=' + encodeURIComponent(PASE);
   if (CIUDAD) u += '&city=' + encodeURIComponent(CIUDAD);
-  const r = await fetch(u, {
-    headers: { 'X-City-Pase': PASE, 'Content-Type': 'application/json' },
-    ...opts,
-  });
-  return r.json() as Promise<T>;
+  let r: Response;
+  try {
+    r = await fetch(u, {
+      headers: { 'X-City-Pase': PASE, 'Content-Type': 'application/json' },
+      ...opts,
+    });
+  } catch (e) {
+    // A request that never came back. This is the one a person cannot report,
+    // because nothing on screen says it happened.
+    if (ruta !== '/api/diario') anota('fetch failed', String(e), ruta);
+    throw e;
+  }
+  const cuerpo = (await r.json()) as T & { error?: string };
+  if (ruta !== '/api/diario' && (!r.ok || cuerpo?.error))
+    anota('api refused', { estado: r.status, error: cuerpo?.error }, ruta);
+  return cuerpo as T;
 }
 
 /** querySelector that refuses to hand back null: a missing element here is a bug
@@ -2684,6 +2722,15 @@ function interruptorDeIdioma(): void {
   };
 }
 
+// Nothing in a browser reports itself. These two are why a person can say "it
+// just did nothing" and be exactly right.
+window.addEventListener('error', (e) =>
+  anota('uncaught error', { mensaje: e.message, fichero: e.filename, linea: e.lineno }),
+);
+window.addEventListener('unhandledrejection', (e) =>
+  anota('unhandled rejection', String((e as PromiseRejectionEvent).reason)),
+);
+
 arrastreDelRail();
 interruptorDeIdioma();
 tema();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agents-city",
-  "version": "0.5.1",
+  "version": "0.5.3",
   "description": "Run autonomous agent cities: one chair seat, role-aware repo agents, repo-owned skills, and explicit roads.",
   "bin": {
     "agents-city": "bin/agents-city.js"

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "city",
   "displayName": "Agents City",
-  "version": "0.5.1",
+  "version": "0.5.3",
   "description": "One autonomous city seat with a work domain, role, goal, repo support agents, recognised skills and explicit roads to other cities.",
   "author": {
     "name": "jlcases",