agents-city 0.5.2 → 0.5.4

package/docs/managed-connect.md

@@ -163,6 +163,11 @@ consuming another capability. A changed body with the same ID is rejected.
 were already admitted. Neither status means that a person or model has read or
 answered the message.
 
+If an identified WebSocket admission temporarily returns `delivery_unavailable`
+or `mailbox_full`, the client makes at most two more attempts with the same
+encrypted envelope. Server-directed delays are capped and receive per-message
+jitter, so a recovering lane is not hit again by every sender at once.
+
 Transport is therefore at-least-once with an idempotent local effect, not a
 fictional exactly-once network. Revocation removes the Road revision, queued
 ciphertext, capabilities and local cryptographic state. Reopening consumes new

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agents-city",
-  "version": "0.5.2",
+  "version": "0.5.4",
   "description": "Run autonomous agent cities: one chair seat, role-aware repo agents, repo-owned skills, and explicit roads.",
   "bin": {
     "agents-city": "bin/agents-city.js"

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "city",
   "displayName": "Agents City",
-  "version": "0.5.2",
+  "version": "0.5.4",
   "description": "One autonomous city seat with a work domain, role, goal, repo support agents, recognised skills and explicit roads to other cities.",
   "author": {
     "name": "jlcases",

package/plugin/channel/hub/lo-que-te-llega.ts

@@ -0,0 +1,78 @@
+/**
+ * What a city says reaches its seat — read from that city's own role file.
+ *
+ * Knowing a `ux` is on the bus does not tell you whether what you changed
+ * concerns them. The answer to that is written in their `roles/<role>.md`,
+ * under "What reaches you" — and until now that file never left the city that
+ * owned it. Each seat judged against its own copy of a catalogue, which is a
+ * guess wearing a document's clothes.
+ *
+ * So it travels, with three rules it cannot break:
+ *
+ *  · The city that OWNS the role publishes it. Nobody describes somebody else.
+ *  · It is bounded before it is published and again before it is read. Two
+ *    processes, two chances to be wrong, and only one of them is ours.
+ *  · It is a CLAIM, never an instruction. It ends up in another seat's model
+ *    context, so it is neutralised the way road messages are.
+ */
+
+import { readFileSync } from 'fs';
+import { join } from 'path';
+import { stripSpecialTokens } from '../untrusted.js';
+
+/** Long enough for a sentence or two of remit, short enough that nobody can
+ * paste a document into somebody else's context. */
+export const LIMITE = 400;
+
+/** The heading that names it, in the format the shipped role files use. */
+const SECCION = /^##\s+What reaches you\s*$/i;
+
+/**
+ * The "What reaches you" section of a role file, as one bounded line.
+ *
+ * Returns '' for anything it cannot read confidently — a missing file, a role
+ * with no such section, a section that is empty. Silence is the honest answer:
+ * "this role did not say" is a fact a reader can act on, and an invented
+ * summary is not.
+ */
+export function loQueLlega(dataDir: string, seatRole: string): string {
+  if (!/^[a-z0-9-]{1,80}$/.test(seatRole)) return '';
+  let texto: string;
+  try {
+    texto = readFileSync(join(dataDir, 'roles', `${seatRole}.md`), 'utf8');
+  } catch {
+    return '';
+  }
+  return limpia(seccion(texto));
+}
+
+/** The body under the heading, up to the next heading or the end. */
+function seccion(texto: string): string {
+  const lineas = texto.split('\n');
+  const desde = lineas.findIndex((l) => SECCION.test(l));
+  if (desde < 0) return '';
+  const cuerpo: string[] = [];
+  for (const linea of lineas.slice(desde + 1)) {
+    if (/^##\s/.test(linea)) break;
+    cuerpo.push(linea);
+  }
+  return cuerpo.join(' ');
+}
+
+/**
+ * One line, bounded, with chat-template delimiters defanged and control
+ * characters removed.
+ *
+ * The neutralising happens on the way OUT as well as on the way in. A city
+ * publishes this about itself, so a city with a tampered role file would
+ * otherwise be handing a forged turn to every neighbour that reads it — and
+ * "the reader will sanitise it" is not a property this side gets to assume.
+ */
+export function limpia(bruto: string): string {
+  const plano = stripSpecialTokens(String(bruto ?? ''))
+    .replace(/[\u0000-\u001f\u007f]/g, ' ')
+    .replace(/\s+/g, ' ')
+    .trim();
+  if (!plano) return '';
+  return plano.length <= LIMITE ? plano : plano.slice(0, LIMITE - 1) + '…';
+}

package/plugin/channel/hub/local-roads.ts

@@ -1,6 +1,7 @@
 import { readFileSync } from 'fs';
 import { join } from 'path';
 import WebSocket from 'ws';
+import { limpia as limpiaRemite } from './lo-que-te-llega.js';
 import { CityContext, runtimeDirForCity } from '../city-config.js';
 import { queueRoad } from '../delivery-queue.js';
 import { BusEnvelope, HubEndpoint, Road, randomId } from '../protocol.js';
@@ -30,6 +31,41 @@ export async function sendLocalRoad(
   }
 }
 
+/**
+ * What the city at the far end says it is, read from its own endpoint file.
+ *
+ * The same file `localRoadOnline` already trusts to decide the city is alive.
+ * Nothing new is trusted here: if that file is good enough to say "this city
+ * exists and is running", it is good enough to say "and it is the design one".
+ */
+export function localRoadPresenta(
+  context: CityContext,
+  road: Road,
+): { domain: string; seatRole: string; recibe: string } | null {
+  try {
+    const endpoint = JSON.parse(
+      readFileSync(join(runtimeDirForCity(context.appHome, road.id), 'endpoint.json'), 'utf8'),
+    ) as HubEndpoint;
+    if (endpoint.cityId !== road.id || endpoint.cityAddress !== road.address) return null;
+    const dicho = endpoint.presenta;
+    if (!dicho || typeof dicho.seatRole !== 'string' || typeof dicho.domain !== 'string')
+      return null;
+    // Untrusted text from another process: bounded and shaped before it is
+    // handed to anybody who might put it in a prompt.
+    const limpio = (valor: string): string =>
+      /^[a-z0-9-]{1,80}$/.test(valor.trim().toLowerCase()) ? valor.trim().toLowerCase() : '';
+    const seatRole = limpio(dicho.seatRole);
+    const domain = limpio(dicho.domain);
+    // Bounded again on the way in. The publisher bounds it too, and that is
+    // the point: the writer is another process, and a reader that trusts a
+    // length because the writer promised one is trusting the wrong side.
+    const recibe = limpiaRemite(typeof dicho.recibe === 'string' ? dicho.recibe : '');
+    return seatRole || domain ? { domain, seatRole, recibe } : null;
+  } catch {
+    return null;
+  }
+}
+
 export function localRoadOnline(context: CityContext, road: Road): boolean {
   try {
     const endpoint = JSON.parse(

package/plugin/channel/hub/road-controller.ts

@@ -12,7 +12,7 @@ import { requireChair } from '../committee/guards.js';
 import { deliverApprovedReception, recordReceptionMessage } from '../reception.js';
 import { wrapUntrusted } from '../untrusted.js';
 import { EnvelopeRouter } from './envelopes.js';
-import { localRoadOnline, sendLocalRoad } from './local-roads.js';
+import { localRoadOnline, localRoadPresenta, sendLocalRoad } from './local-roads.js';
 import { remoteRoadBridge } from './remote-roads.js';
 import { managedReceptionBridge } from '../managed-connect/reception-bridge.js';
 
@@ -132,10 +132,35 @@ export function roadController(context: CityContext, router: EnvelopeRouter) {
   ): Promise<unknown> => {
     if (name === 'road.roster') {
       requireChair(actor, role);
-      return roads().map((road) => ({
-        ...road,
-        online: road.local ? localRoadOnline(context, road) : remote.online(road.address),
-      }));
+      return roads().map((road) => {
+        const online = road.local ? localRoadOnline(context, road) : remote.online(road.address);
+        // What the far city says about itself wins over what whoever opened
+        // this road assumed — and the entry says which of the two you are
+        // reading, because "cpto because they say so" and "cpto because I
+        // wrote it down once" are not the same claim, and only one of them is
+        // safe to act on.
+        const dicho = road.local && online ? localRoadPresenta(context, road) : null;
+        // Per field, not per entry. A city can publish a good domain and a role
+        // that is not a role — and then one `segun` for the whole row would say
+        // "the city itself" over a role the city never validly claimed. Whoever
+        // is deciding "does this reach that role" needs to know whether THE
+        // ROLE is confirmed, and the domain's provenance does not answer that.
+        const suRol = dicho?.seatRole ?? '';
+        const suDominio = dicho?.domain ?? '';
+        const nota = 'this city’s own note';
+        const ella = 'the city itself';
+        return {
+          ...road,
+          ...(suRol ? { role: suRol } : {}),
+          ...(suDominio ? { domain: suDominio } : {}),
+          // What that city says reaches it. A claim, in their words, and the
+          // only thing here that turns "a ux is connected" into "this concerns
+          // them". Absent when they did not say.
+          ...(dicho?.recibe ? { recibe: dicho.recibe } : {}),
+          online,
+          segun: { role: suRol ? ella : nota, domain: suDominio ? ella : nota },
+        };
+      });
     }
     if (name === 'road.inbox') {
       requireChair(actor, role);