agents-city 0.5.5 → 0.5.6

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "city",
       "source": "./plugin",
-      "version": "0.5.5",
+      "version": "0.5.6",
       "description": "Operate one autonomous city seat, its domain, role, repo support agents, goal, recognised skills and explicit roads to other cities."
     }
   ]

package/README.es.md

@@ -1828,14 +1828,22 @@ global del plugin porque varias ciudades pueden ejecutarse a la vez.
 sexta pregunta del asistente o con `agents-city seat --seat-yolo on|off`;
 `--no-yolo` sigue frenando la sesión entera.
 
-`seat_reach` dice si la silla tiene manos dentro de los mounts de sus agentes.
-Está `closed` mientras no escribas `open`, y cerrado significa que una llamada a
-una herramienta que cae sobre un repo, un worktree o una carpeta de documentos
-que montó un agente se rechaza, con el nombre de quien es su dueño, su rol y el
-comando que le pregunta. La silla conserva la carpeta de la ciudad, las
-carreteras y el registro. Existe porque el fallo que evita no deja rastro: un
-asiento que lee el código y responde es idéntico a uno que consultó a sus
-especialistas.
+`seat_reach` dice si la silla trabaja con sus propias manos. Está `closed`
+mientras no escribas `open`. Cerrado significa que un asiento tiene las
+herramientas de una silla y ninguna más: su carpeta de ciudad, las puertas de
+este producto (`agents-city …`, que es toda la shell que tiene), el bus de la
+ciudad, y pensar en voz alta. Una carpeta fuera de la ciudad, un comando que no
+es una puerta, una búsqueda, una descarga o el MCP de un proveedor se rechazan
+por su nombre, diciendo a quién preguntar.
+
+Esos tres últimos son la razón de que esto vaya de herramientas y no de
+carpetas. Un asiento al que le piden una decisión de producto puede traerse sus
+propias analíticas, responder bien, no pisar el terreno de nadie — y dejar fuera
+de la conversación a todos los especialistas que le diste. Ese fallo no deja
+rastro: es idéntico a un asiento que consultó a su ciudad. Cuando llega una
+pregunta, al asiento se le pone además delante las dos listas — sus agentes, y
+las ciudades de sus carreteras con el rol que cada una dice tener — porque a
+veces la respuesta no está ni en sus carpetas ni en su ciudad.
 
 ### `<owner>.md`: ficha del asiento
 

package/README.md

@@ -1808,13 +1808,20 @@ launches the chair itself without permission prompts — set at the wizard's
 sixth question or with `agents-city seat --seat-yolo on|off`; `--no-yolo`
 still brakes the whole session.
 
-`seat_reach` says whether the chair has hands inside its agents' mounts. It is
-`closed` unless you write `open`, and closed means a tool call landing on a
-repo, worktree or document folder an agent mounted is refused, with the owner's
-name, their role and the one command that asks them. The chair keeps the city
-folder, the roads and the record. This exists because the failure it prevents is
-silent: a seat that reads the code and answers looks exactly like a seat that
-consulted its specialists.
+`seat_reach` says whether the chair works with its own hands. It is `closed`
+unless you write `open`. Closed means a seat holds a chair's tools and nothing
+else: its own city folder, this product's own doors (`agents-city …` — that is
+the whole shell it has), the city bus, and thinking out loud. A folder outside
+the city, a shell command that is not a door, a search, a fetch or a vendor's
+MCP server are refused by name, with who to ask instead.
+
+The last three are the reason this is about tools and not folders. A seat asked
+for a product decision can pull its own analytics, answer well, trespass on
+nothing — and leave every specialist it was given out of the conversation. That
+failure is silent: it looks exactly like a seat that consulted its city. When a
+question arrives, the seat is also handed both rosters — its agents, and the
+cities on its roads with the role each one says it has — because the answer is
+sometimes in neither its folders nor its own city.
 
 ### `<owner>.md`: seat card
 

package/bin/test

@@ -92,6 +92,7 @@ necesarios = ["bin/agents-city.js", "bin/hall", "bin/seat", "bin/city", "bin/dem
               "plugin/scripts/reset.py", "plugin/scripts/desinstala.py",
               "plugin/scripts/demos.py", "plugin/scripts/arnes.py",
               "plugin/scripts/diario.py", "plugin/scripts/alcance.py",
+              "plugin/scripts/consulta.py",
               "plugin/channel/runtime/arnes.json", "plugin/scripts/capabilities.py",
               "plugin/scripts/deliberations.py",
               "plugin/scripts/runtime_processes.py",

package/bin/test-alcance.py

@@ -32,7 +32,9 @@ sys.path.insert(0, os.path.join(RAIZ, "plugin", "scripts"))
 
 import alcance  # noqa: E402
 import cities  # noqa: E402
+import consulta  # noqa: E402
 import diario  # noqa: E402
+import roads  # noqa: E402
 import seat as S  # noqa: E402
 import workspace  # noqa: E402
 from testlib import afirma, comprueba, resumen, roster  # noqa: E402
@@ -82,6 +84,10 @@ def juzga(datos, herramienta, entrada, cwd=None, **extra):
     )
 
 
+def decision_de(veredicto):
+    return ((veredicto or {}).get("hookSpecificOutput") or {}).get("permissionDecision", "")
+
+
 def razon(veredicto):
     return ((veredicto or {}).get("hookSpecificOutput") or {}).get("permissionDecisionReason", "")
 
@@ -113,14 +119,21 @@ def lo_que_sigue_pudiendo(datos, api):
         is None,
     )
     afirma(
-        "· happy: a shell command that names no place at all",
-        juzga(datos, "Bash", {"command": "git status"}) is None,
+        "· happy: and its own record, written not just read",
+        juzga(datos, "Write", {"file_path": os.path.join(datos, "roles", "cpto.md")}) is None,
+    )
+    afirma(
+        "· happy: the bus is its voice, so its own bus tools pass",
+        all(juzga(datos, t, {}) is None for t in
+            ("mcp__city-bus__bus_roster", "mcp__plugin_city_city-bus__bus_send")),
     )
     afirma(
-        "· happy: somewhere nobody in this city owns",
-        juzga(datos, "Read", {"file_path": os.path.join(datos, "..", "nada.txt")}) is None,
+        "· happy: and thinking out loud costs nobody anything",
+        all(juzga(datos, t, {}) is None
+            for t in ("TodoWrite", "Skill", "SlashCommand", "ExitPlanMode")),
     )
 
+
     # The refusal recommends `agents-city committee open --question "..."`, and a
     # brief about a repo names that repo. A guard that denies its own remedy is
     # a guard that just stops the seat.
@@ -137,28 +150,23 @@ def lo_que_sigue_pudiendo(datos, api):
         "· happy: and neither is the repo's own committee door",
         juzga(datos, "Bash", {"command": f"./bin/committee open --member api # {api}"}) is None,
     )
-    # Prose that happens to contain a path is prose.
+    # A brief quotes the folder it is about. That prose must survive inside the
+    # one shell a chair has, or the refusal would be denying its own remedy.
     afirma(
-        "· happy: a quoted sentence that mentions a folder is not a hand in it",
-        juzga(datos, "Bash", {"command": f'echo "the answer is somewhere under {api}/app"'})
-        is None,
+        "· happy: a door whose question quotes a folder is still a door",
+        juzga(datos, "Bash", {
+            "command": f'agents-city committee open --member api '
+                       f'--question "what should change under {api}/app"'}) is None,
     )
     afirma(
-        "· happy: even when the sentence starts with the folder",
-        juzga(datos, "Bash", {"command": f'echo "{api}/app is where it lives"'}) is None,
+        "· happy: even when the question starts with the folder",
+        juzga(datos, "Bash", {
+            "command": f'agents-city committee open --member api '
+                       f'--question "{api}/app is where it lives"'}) is None,
     )
     afirma(
         "· happy: and a sibling folder whose name merely starts the same way",
-        juzga(datos, "Read", {"file_path": f"{api}-viejo/router.rb"}) is None,
-    )
-    # The other side of that tiebreaker: a folder with a space in its name is a
-    # real folder, and plenty of people have one.
-    con_espacio = os.path.join(os.path.dirname(api), "api", "app", "mis notas.md")
-    open(con_espacio, "w").write("# notas\n")
-    afirma(
-        "· non-happy: a real path with a space in it is still that agent's ground",
-        juzga(datos, "Bash", {"command": f'cat "{con_espacio}"'}) is not None,
-        con_espacio,
+        juzga(datos, "Read", {"file_path": os.path.join(datos, "roles")}) is None,
     )
 
     afirma(
@@ -265,6 +273,64 @@ def lo_que_ya_no_puede(datos, api, docs):
     )
 
 
+# ── a chair holds a chair's tools ────────────────────────────────────────────
+
+
+def las_manos_de_una_silla(datos, api):
+    """The half that folders never covered.
+
+    A seat asked for a product decision read nobody's files, trespassed on
+    nothing, called two of its vendor's SEO tools and answered alone — while
+    three configured specialists never heard the question. A guard that only
+    watches folders records that as a clean turn, which is why the rule is now
+    what a chair IS rather than where it may go.
+    """
+    print("  and it holds a chair's tools, not the work's")
+
+    fuera_de_la_ciudad = [
+        ("a search", "WebSearch", {"query": "menu information architecture"}),
+        ("a fetch", "WebFetch", {"url": "https://example.invalid/x"}),
+        ("somebody else's MCP server", "mcp__claude_ai_Nexo__seo_get_site_context", {}),
+        ("another vendor's, spelled differently", "mcp__slack__slack_send_message", {}),
+        ("hiring hands that are not its houses", "Task", {"prompt": "go and find out"}),
+        ("a shell that is not a door", "Bash", {"command": "ls -la"}),
+        ("a shell that leaves the machine", "Bash", {"command": "curl https://example.invalid"}),
+        ("a file that belongs to nobody here", "Read", {"file_path": "/etc/hosts"}),
+    ]
+    for nombre, herramienta, entrada in fuera_de_la_ciudad:
+        v = juzga(datos, herramienta, entrada)
+        afirma(f"· non-happy: {nombre}", (v or {}) and decision_de(v) == "deny",
+               f'{herramienta} {json.dumps(entrada)[:80]}')
+
+    # The one from the report, in full: nothing is trespassed and the answer is
+    # still one model's.
+    texto = razon(juzga(datos, "mcp__claude_ai_Nexo__seo_get_site_context", {}))
+    afirma("· the refusal says why a clean turn is still the wrong turn",
+           "leaves no trace" in texto, texto[:300])
+    afirma("· and names everyone this city has, with their roles",
+           "api" in texto and "dev" in texto and "manual" in texto and "seo" in texto,
+           texto[:400])
+    afirma("· and how to ask one of them",
+           "agents-city committee open" in texto and "--member" in texto, texto[:400])
+    afirma("· and that the answer may not be in this city at all",
+           "bus_roster" in texto and "bus_send" in texto, texto[-500:])
+
+    afirma("· non-happy: and a bare shell says what a chair's shell is",
+           "agents-city committee" in razon(juzga(datos, "Bash", {"command": "ls -la"})))
+
+    # A chair with nobody to ask is a person with a terminal.
+    sola = tempfile.mkdtemp()
+    with open(os.path.join(sola, "city.yml"), "w", encoding="utf-8") as f:
+        f.write("owner: ana\nname: sola\nslug: sola\nid: city-alcance-sola\n")
+    S.escribe_ficha(os.path.join(sola, "ana.md"), "ana", "cpto", [])
+    afirma(
+        "· happy: a city with no agents yet does not come with its seat bricked",
+        juzga(sola, "WebSearch", {"query": "anything"}) is None
+        and juzga(sola, "Bash", {"command": "ls"}) is None,
+    )
+    shutil.rmtree(sola, ignore_errors=True)
+
+
 # ── the owner decides, and the guard never decides for them ──────────────────
 
 
@@ -274,7 +340,8 @@ def la_puerta_del_dueno(datos, api):
     afirma("· closed is the default", juzga(datos, "Read", dentro) is not None)
     afirma(
         "· happy: CITY_SEAT_REACH=open gives the chair its hands, now",
-        juzga(datos, "Read", dentro, CITY_SEAT_REACH="open") is None,
+        juzga(datos, "Read", dentro, CITY_SEAT_REACH="open") is None
+        and juzga(datos, "WebSearch", {"query": "x"}, CITY_SEAT_REACH="open") is None,
     )
     cities.pon_clave(datos, "seat_reach", "open")
     try:
@@ -291,6 +358,77 @@ def la_puerta_del_dueno(datos, api):
     )
 
 
+# ── and it is told who it has, when the question arrives ─────────────────────
+
+
+def el_momento_de_decidir(datos):
+    """Stopping the chair is half of it; the other half is knowing who to ask.
+
+    A refusal that arrives after the seat has started is a correction. The plan
+    has to happen where the question lands — and it has to carry BOTH rosters,
+    because a city can be missing the answer in two ways: no agent here does
+    that work, or the answer belongs to somebody else's city entirely.
+    """
+    print("  and it is told who it has, at the moment the question arrives")
+    roads.escribe(datos, [{
+        "id": "road_0000000000000000000000000000abcd",
+        "address": "bea/comunidad",
+        "owner": "bea",
+        "name": "comunidad",
+        "role": "ux",
+        "domain": "marketing",
+        "local": True,
+    }])
+    nota = consulta.contexto(datos)
+    afirma("· it names every agent in this city, with its role",
+           "api" in nota and "dev" in nota and "manual" in nota and "seo" in nota, nota)
+    afirma("· and how much ground each of them holds",
+           "1 folder" in nota, nota)
+    afirma("· it names the cities on the roads too, with what they do",
+           "bea/comunidad" in nota and "ux" in nota and "marketing" in nota, nota)
+    afirma("· and says a road's role came from a note, not from that city",
+           "note" in nota, nota)
+    afirma("· it offers both routes, because the answer may be in neither place",
+           "agents-city committee open" in nota and "bus_send" in nota, nota)
+    afirma("· and says that deciding nobody is a decision, not a shortcut",
+           "concerns nobody" in nota, nota[-400:])
+
+    def por_el_gancho(prompt, **extra):
+        env = dict(os.environ)
+        env.update({"CLAUDE_PLUGIN_ROOT": os.path.join(RAIZ, "plugin"),
+                    "AGENTS_CITY_DATA": datos, "CITY_BUS_ACTOR": "seat"})
+        env.update(extra)
+        r = subprocess.run(
+            ["/bin/bash", os.path.join(RAIZ, "plugin", "hooks", "who-does-this-concern.sh")],
+            input=json.dumps({"prompt": prompt}), capture_output=True, text=True, env=env,
+        )
+        try:
+            return json.loads(r.stdout or "{}"), r
+        except ValueError:
+            return {}, r
+
+    salida, r = por_el_gancho("I want to improve the menu, people cannot find things")
+    afirma("· the hook itself puts it in front of the seat",
+           "api" in ((salida.get("hookSpecificOutput") or {}).get("additionalContext") or ""),
+           f"{r.stdout[:200]} {r.stderr[-200:]}")
+    salida, _ = por_el_gancho("/city:round")
+    comprueba("· non-happy: a slash command already carries its own instructions",
+              salida, {})
+    salida, _ = por_el_gancho("sigue")
+    comprueba("· non-happy: and a two-word reply is not a question to route", salida, {})
+    salida, _ = por_el_gancho("I want to improve the menu, people cannot find things",
+                              CITY_BUS_ACTOR="api")
+    comprueba("· non-happy: a house is not chairing anything", salida, {})
+    salida, _ = por_el_gancho("I want to improve the menu, people cannot find things",
+                              AGENTS_CITY_DATA="")
+    comprueba("· non-happy: and with no city there is nobody to name", salida, {})
+    roads.escribe(datos, [])
+
+    hooks = json.load(open(os.path.join(RAIZ, "plugin", "hooks", "hooks.json")))
+    afirma("· and Claude is told to run it when a prompt arrives",
+           "who-does-this-concern.sh" in json.dumps(hooks["hooks"]["UserPromptSubmit"]))
+
+
 # ── a guard that breaks a turn is worse than no guard ────────────────────────
 
 
@@ -356,7 +494,8 @@ def nunca_rompe_el_turno(datos, api):
         "· non-happy: a tool_input that is not an object",
         juzga(datos, "Read", "no soy un objeto") is None,
     )
-    afirma("· non-happy: an empty command", juzga(datos, "Bash", {"command": ""}) is None)
+    afirma("· non-happy: an empty command is not a door either",
+           juzga(datos, "Bash", {"command": ""}) is not None)
     afirma(
         "· non-happy: an unbalanced quote still gets read",
         juzga(datos, "Bash", {"command": f"grep -r ' {api}/app"}) is not None,
@@ -388,12 +527,12 @@ def nunca_rompe_el_turno(datos, api):
 def queda_escrito(datos, api):
     print("  every refusal is on disk before anybody has to remember it")
     antes = len(diario.lee(datos))
-    juzga(datos, "Bash", {"command": f"grep -rn router {api}"})
+    juzga(datos, "Grep", {"pattern": "router", "path": api})
     lineas = [x for x in diario.lee(datos) if x.get("tipo") == "alcance"]
     afirma("· the refusal is journalled", len(diario.lee(datos)) > antes and lineas, str(lineas))
     ultima = lineas[-1]
     comprueba("· with the agent whose ground it was", ultima.get("agente"), "api")
-    comprueba("· and the tool that tried", ultima.get("herramienta"), "Bash")
+    comprueba("· and the tool that tried", ultima.get("herramienta"), "Grep")
     afirma("· and the exact path", api in str(ultima.get("ruta")), str(ultima))
 
 
@@ -440,8 +579,9 @@ def el_gancho_de_verdad(datos, api):
     # nobody registered is a file.
     hooks = json.load(open(os.path.join(RAIZ, "plugin", "hooks", "hooks.json")))
     texto = json.dumps(hooks["hooks"]["PreToolUse"])
-    afirma("· and Claude is told to run it before every tool that names a place",
-           "ask-the-house.sh" in texto and "Bash" in texto and "Grep" in texto, texto[:400])
+    afirma("· and Claude is told to run it before EVERY tool, not a list of them",
+           "ask-the-house.sh" in texto and '"matcher": "*"' in texto,
+           'a list of tools is a list of the ways somebody thought of')
 
 
 def main():
@@ -451,6 +591,8 @@ def main():
     try:
         lo_que_sigue_pudiendo(datos, api)
         lo_que_ya_no_puede(datos, api, docs)
+        las_manos_de_una_silla(datos, api)
+        el_momento_de_decidir(datos)
         la_puerta_del_dueno(datos, api)
         nunca_se_lleva_la_ciudad_por_delante(base, api)
         nunca_rompe_el_turno(datos, api)

package/bin/test-e2e.py

@@ -298,8 +298,8 @@ def main():
         propio, _ = llama_al_gancho(mundo, sesion, "Read", {"file_path": ficha})
         comprueba("· happy: its own card is its own business", decision(propio), "")
         ajeno, bruto = llama_al_gancho(
-            mundo, sesion, "Bash",
-            {"command": f"cd {mundo.repo} && grep -rn router app"},
+            mundo, sesion, "Read",
+            {"file_path": os.path.join(mundo.repo, "app", "router.rb")},
         )
         comprueba("· non-happy: its agent's repo is not", decision(ajeno), "deny")
         afirma(
@@ -315,6 +315,18 @@ def main():
             decision(otro) == "deny" and "manual" in motivo(otro),
             motivo(otro)[:200],
         )
+        # The half that folders never covered: work that trespasses on nobody.
+        vendedor, _ = llama_al_gancho(
+            mundo, sesion, "mcp__claude_ai_Nexo__seo_get_site_context", {})
+        afirma(
+            "· non-happy: and neither is a vendor's tool that touches nobody's files",
+            decision(vendedor) == "deny" and "api" in motivo(vendedor)
+            and "bus_send" in motivo(vendedor),
+            motivo(vendedor)[:300],
+        )
+        suelto, _ = llama_al_gancho(mundo, sesion, "Bash", {"command": "ls -la /"})
+        comprueba("· non-happy: nor a shell that is not one of this product's doors",
+                  decision(suelto), "deny")
         puerta, _ = llama_al_gancho(
             mundo, sesion, "Bash",
             {"command": f'agents-city committee open --member api --question "about {mundo.repo}"'},

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agents-city",
-  "version": "0.5.5",
+  "version": "0.5.6",
   "description": "Run autonomous agent cities: one chair seat, role-aware repo agents, repo-owned skills, and explicit roads.",
   "bin": {
     "agents-city": "bin/agents-city.js"

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "city",
   "displayName": "Agents City",
-  "version": "0.5.5",
+  "version": "0.5.6",
   "description": "One autonomous city seat with a work domain, role, goal, repo support agents, recognised skills and explicit roads to other cities.",
   "author": {
     "name": "jlcases",

package/plugin/commands/goals.md

@@ -4,7 +4,7 @@ argument-hint: ""
 allowed-tools: Read, Write, Edit, Bash, Glob, Grep
 ---
 
-Source `${CLAUDE_PLUGIN_ROOT}/scripts/city-env.sh`, then read the owner from
+Read the owner from
 `$AGENTS_CITY_DATA/city.yml` and that owner's single card.
 
 With no requested change, show the current goal: title, signal, command or manual

package/plugin/commands/notice.md

@@ -7,7 +7,7 @@ allowed-tools: Read, Bash, Glob, Grep, mcp__plugin_city_city-bus__bus_send, mcp_
 Read the `city` skill's Notices section. Inspect the requested diff and separate
 observed facts from guesses. Do not notify merely because files changed.
 
-Source `${CLAUDE_PLUGIN_ROOT}/scripts/city-env.sh`, call `bus_roster`, and choose
+Call `bus_roster` and choose
 only explicit road destinations whose role/domain may be affected. If none match,
 say so and send nothing.
 

package/plugin/commands/session.md

@@ -4,7 +4,7 @@ argument-hint: "[--no-yolo] [--only r1,r2]"
 allowed-tools: Read, Bash, Glob, Grep
 ---
 
-Source `${CLAUDE_PLUGIN_ROOT}/scripts/city-env.sh` and run:
+Run:
 
 ```bash
 "$CLAUDE_PLUGIN_ROOT/scripts/city-session.sh" "$AGENTS_CITY_USER" --claude $ARGUMENTS

package/plugin/commands/settings.md

@@ -4,7 +4,7 @@ argument-hint: "[domain | role | repos | agent-roles | goal | engines | roads |
 allowed-tools: Read, Write, Edit, Bash, Glob, Grep
 ---
 
-Source `${CLAUDE_PLUGIN_ROOT}/scripts/city-env.sh` first. Show the active city
+The seat window already carries the active city in its environment. Show it
 address and path before changing anything.
 
 - `domain`, `role`, `repos`, `agent-roles`, `goal`, `engines`: run the corresponding option of

package/plugin/commands/team.md

@@ -7,7 +7,7 @@ allowed-tools: Read, Bash, Glob, Grep, mcp__plugin_city_city-bus__bus_roster, mc
 This command keeps its old name as a compatibility alias, but do not describe a
 city as a team of people.
 
-1. Source `${CLAUDE_PLUGIN_ROOT}/scripts/city-env.sh`.
+1. Read `$AGENTS_CITY_DATA`, which the launcher already set in this window.
 2. Run `python3 "${CLAUDE_PLUGIN_ROOT}/scripts/cities.py" list`.
 3. Read this city's `roads.json` and owner card only.
 4. Call `bus_roster` when available.

package/plugin/hooks/ask-the-house.sh

@@ -1,13 +1,18 @@
 #!/usr/bin/env bash
-# PreToolUse / every tool that names a place — the chair's hands.
+# PreToolUse / every tool — the chair's hands.
 #
-# The seat decides; the houses investigate. Left as advice in the skill, that
-# lasted exactly as long as it took for reading the repo to be quicker than
-# asking the agent who lives in it. So the seat is stopped at the ground it does
-# not own, and told whose it is and how to ask.
+# The seat decides; the agents work. Left as advice in the skill, that lasted
+# exactly as long as it took for doing it to be quicker than asking.
 #
-# Only the seat. A house inside its own mounts is where it belongs, and this
-# leaves every other runtime untouched.
+# It began as a guard on FOLDERS, and folders turned out to be half the story: a
+# seat asked for a product decision trespassed on nothing, called two of its
+# vendor's SEO tools, and answered alone while three configured specialists never
+# heard the question. So the matcher is every tool, and what is allowed is what a
+# chair is: its own city folder, this product's own doors, its own voice on the
+# bus, and thinking out loud.
+#
+# Only the seat. An agent using its tools is an agent doing its job, and every
+# other runtime is left untouched.
 set -uo pipefail
 # Outside a city runtime the whole plugin stays silent (see the guard).
 . "$(dirname "$0")/solo-en-ciudad.sh"

package/plugin/hooks/hooks.json

@@ -22,7 +22,7 @@
         ]
       },
       {
-        "matcher": "Bash|Edit|Write|MultiEdit|NotebookEdit|Read|Grep|Glob",
+        "matcher": "*",
         "hooks": [
           {
             "type": "command",
@@ -61,6 +61,15 @@
             "timeout": 10
           }
         ]
+      },
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "\"${CLAUDE_PLUGIN_ROOT}/hooks/who-does-this-concern.sh\"",
+            "timeout": 15
+          }
+        ]
       }
     ],
     "Stop": [

package/plugin/hooks/who-does-this-concern.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# UserPromptSubmit — the moment a chair decides who it needs.
+#
+# The tool guard stops a seat from doing the work. It does not make the seat know
+# who to ask, and a refusal that arrives after it has already started is a
+# correction rather than a plan. This runs where the question lands, and puts
+# both rosters in front of it: the agents in this city, and the other cities on
+# its roads with the role each one says it has.
+#
+# The roads half matters as much as the agents half. A question about a product
+# that competes with somebody else's is not answered by any folder in this city.
+set -uo pipefail
+# Outside a city runtime the whole plugin stays silent (see the guard).
+. "$(dirname "$0")/solo-en-ciudad.sh"
+
+# `{}` rather than nothing: an empty hook answer logs a spurious error upstream.
+[ "${CITY_BUS_ACTOR:-}" = "seat" ] || { printf '{}\n'; exit 0; }
+[ -n "${AGENTS_CITY_DATA:-}" ] || { printf '{}\n'; exit 0; }
+
+ROOT="${CLAUDE_PLUGIN_ROOT:-$(cd "$(dirname "$0")/.." && pwd)}"
+export CLAUDE_PLUGIN_ROOT="$ROOT"
+exec python3 "$ROOT/scripts/consulta.py"

package/plugin/scripts/alcance.py

@@ -58,6 +58,17 @@ MAGIA = re.compile(r"[*?\[]")
 #: be the thing that stops it asking.
 PUERTAS = ("agents-city", "committee", "bus", "road", "agents", "seat", "cities", "skills")
 
+#: Tools that reach into a place. Allowed on the chair's own desk, nowhere else.
+SOBRE_SU_MESA = ("Read", "Write", "Edit", "MultiEdit", "NotebookEdit", "Grep", "Glob")
+
+#: Tools that produce nothing outside this conversation: a plan, a question, a
+#: command of this product's own. A chair may think out loud.
+SIN_EFECTO = ("TodoWrite", "Skill", "SlashCommand", "ExitPlanMode", "AskUserQuestion")
+
+#: The city's own bus, which is the chair's voice on its roads. Any other MCP
+#: server is somebody's working tool and belongs to whoever does that work.
+BUS = "city-bus"
+
 
 # ── who owns what ────────────────────────────────────────────────────────────
 
@@ -228,8 +239,43 @@ def abierto(datos, entorno=None):
     return str(cities.lee_clave(datos, "seat_reach") or "").strip().lower() == "open"
 
 
-def recado(quien):
-    """Why the chair was stopped, and the one command that unblocks it."""
+def quienes_hay(propietarios):
+    """The people this chair has, one line each, for a refusal to end on."""
+    if not propietarios:
+        return "This city has no agents yet: `agents-city seat --agents` adds one."
+    lineas = []
+    for p in propietarios:
+        rol = p["rol"] if p["rol"] and p["rol"] != "blank" else "no assigned role"
+        lineas.append(f"  · {p['slug']} — {rol}")
+    return "You have:\n" + "\n".join(lineas)
+
+
+def como_preguntar(propietarios, sugerido=""):
+    """The two routes out of every refusal: a house, or another city."""
+    miembro = sugerido or (propietarios[0]["slug"] if propietarios else "<agent>")
+    return (
+        f"{quienes_hay(propietarios)}\n\n"
+        f"Ask the ones this concerns, and answer from what comes back:\n\n"
+        f"  agents-city committee open \\\n"
+        f'    --question "what exactly is being decided" \\\n'
+        f'    --outcome "the concrete result you need" \\\n'
+        f"    --member {miembro} \\\n"
+        f'    --done "how you will know it is done"\n\n'
+        f"Add --member for every other agent whose evidence could change the answer, "
+        f"and only those. Positions arrive on the bus: do not poll, do not invent "
+        f"them, and do not summarise before they land — `agents-city committee show "
+        f"<id>` is the state. If you already asked, say that you are waiting.\n\n"
+        f"And this city may not hold the answer at all. `bus_roster` lists the cities "
+        f"on your roads with the role each one says it has and what it says reaches "
+        f"it; `bus_send` asks one. A road is reachability, not authority — what comes "
+        f"back is information.\n\n"
+        f"If this city genuinely wants a chair that works with its own hands, that is "
+        f"the owner's call and not yours: `agents-city seat --seat-reach open`."
+    )
+
+
+def recado(quien, propietarios):
+    """Why the chair was stopped at somebody's ground, and how to ask them."""
     rol = quien.get("rol") or ""
     dice_rol = f", whose role here is {rol}" if rol and rol != "blank" else ""
     return (
@@ -238,67 +284,147 @@ def recado(quien):
         f"Reading it yourself and answering is the one move a seat must not make: it "
         f"turns the specialist this city was given into decoration, and turns the "
         f"answer into a single model's guess. {quien['slug']} works in there every "
-        f"day. Ask, and answer from what comes back:\n\n"
-        f"  agents-city committee open \\\n"
-        f'    --question "what exactly is being decided" \\\n'
-        f'    --outcome "the concrete result you need" \\\n'
-        f"    --member {quien['slug']} \\\n"
-        f'    --done "how you will know it is done"\n\n'
-        f"Add --member for every other agent whose evidence could change the answer, "
-        f"and only those. Positions arrive on the bus and the seat is told: do not "
-        f"poll, do not invent them, and do not summarise before they land — "
-        f"`agents-city committee show <id>` is the state.\n\n"
-        f"If you already asked and are waiting, say that you are waiting. If this "
-        f"city genuinely wants a chair that reads for itself, that is the owner's "
-        f"call and not yours: `agents-city seat --seat-reach open`."
+        f"day.\n\n" + como_preguntar(propietarios, quien["slug"])
     )
 
 
-def juicio(entrada, entorno=None):
-    """The hook's answer to one tool call: a refusal, or nothing at all."""
-    entorno = os.environ if entorno is None else entorno
+def fuera_de_la_mesa(ruta, propietarios):
+    """Stopped somewhere that belongs to nobody here, which is still not the chair's."""
+    return (
+        f"{ruta} is outside this city, and a chair's desk is its own city: the card, "
+        f"the roles, the record, the roads. Everywhere else belongs to whoever works "
+        f"there.\n\n"
+        f"You were not stopped because that path is dangerous. You were stopped "
+        f"because reading it yourself is how an answer stops being the city's and "
+        f"becomes one model's.\n\n" + como_preguntar(propietarios)
+    )
+
+
+def no_es_una_puerta(orden, propietarios):
+    """A chair does not run commands; it opens its own doors."""
+    corto = orden if len(orden) <= 120 else orden[:119] + "…"
+    return (
+        f"`{corto}` is work, and work is what this city has agents for.\n\n"
+        f"The shell a chair has is this product's own doors — `agents-city committee`, "
+        f"`bus`, `road`, `cities`, `agents`, `seat`, `skills`. Everything else a "
+        f"command would do for you, somebody here does better, and their answer comes "
+        f"with the evidence yours would not have.\n\n" + como_preguntar(propietarios)
+    )
+
+
+def no_son_tus_manos(herramienta, propietarios):
+    """An outside tool: the work itself, arriving through a door with no ground."""
+    return (
+        f"`{herramienta}` fetches or does. A chair decides, and to decide it asks — "
+        f"which is the whole reason this city has more than one seat in it.\n\n"
+        f"This one is worth saying plainly because it leaves no trace on anybody's "
+        f"folders: a search, a fetch, a vendor's MCP server. Nothing is trespassed "
+        f"and the specialists still never hear the question, which is the same "
+        f"failure wearing better manners.\n\n" + como_preguntar(propietarios)
+    )
+
+
+def _fuera_de_juego(herramienta, datos, entorno):
+    """Whether this call is none of the guard's business, before any file is read.
+
+    Four ways: it is not the chair calling; there is no city to be the chair of;
+    the owner opened the chair's hands on purpose; or the tool produces nothing
+    outside this conversation — a plan, a question, one of this product's own
+    commands, or the city's own bus, which is the chair's voice and not a tool.
+    """
     if str(entorno.get("CITY_BUS_ACTOR", "")) != "seat":
-        return None
-    datos = str(entorno.get("AGENTS_CITY_DATA") or "")
+        return True
     if not datos or not os.path.isdir(datos):
-        return None
+        return True
     if abierto(datos, entorno):
-        return None
-    herramienta = str(entrada.get("tool_name") or "")
+        return True
+    if herramienta in SIN_EFECTO:
+        return True
+    return herramienta.startswith("mcp__") and BUS in herramienta
+
+
+def _sobre_la_mesa(entrada, herramienta, datos, propietarios):
+    """A place-reaching tool, judged against the chair's own desk.
+
+    Returns `(refusal, journal fields)` or None. Inside the city folder there is
+    nothing to say: the card, the roles, the record and the roads are what a
+    chair is for.
+    """
     sitios = candidatas(herramienta, entrada.get("tool_input"), str(entrada.get("cwd") or ""))
-    if not sitios:
+    fuera = [r for r in sitios if not rutas.dentro_de(r, datos)]
+    if not fuera:
         return None
-    owner = cities.lee_clave(datos, "owner") or ""
-    texto = card.lee(os.path.join(datos, f"{owner}.md")).get("texto") or ""
-    if not texto:
-        return None
-    try:
-        propietarios = duenos(datos, texto)
-    except (OSError, ValueError):
-        return None
-    quien = de_quien(sitios, propietarios)
-    if not quien:
-        return None
-    # Always written down. When this refuses something it should not have, the
-    # owner should not have to reproduce it to show me — the line is on disk.
-    diario.apunta(
-        datos,
-        "alcance",
-        herramienta=herramienta,
-        ruta=quien["ruta"],
-        agente=quien["slug"],
-        rol=quien["rol"],
-        mount=quien["mount"],
-    )
+    quien = de_quien(fuera, propietarios)
+    if quien:
+        return recado(quien, propietarios), {
+            "motivo": "somebody's ground", "ruta": quien["ruta"],
+            "agente": quien["slug"], "rol": quien["rol"],
+        }
+    return fuera_de_la_mesa(fuera[0], propietarios), {
+        "motivo": "off the desk", "ruta": fuera[0],
+    }
+
+
+def _niega(motivo):
     return {
         "hookSpecificOutput": {
             "hookEventName": "PreToolUse",
             "permissionDecision": "deny",
-            "permissionDecisionReason": recado(quien),
+            "permissionDecisionReason": motivo,
         }
     }
 
 
+def juicio(entrada, entorno=None):
+    """The hook's answer to one tool call: a refusal, or nothing at all.
+
+    The rule is not "stay out of your agents' folders". It is that a chair holds
+    a chair's tools: its own city, its own doors, its own voice on the roads.
+    Everything else — a shell, a search, somebody's vendor MCP — is the work,
+    and the work is what this city has agents for.
+
+    That distinction is not pedantry. A seat asked for a product decision read no
+    file belonging to anybody, trespassed on nothing, called two SEO tools of its
+    own and answered alone. Three configured specialists never heard the
+    question. A guard that only watches folders records that as a clean turn.
+    """
+    entorno = os.environ if entorno is None else entorno
+    datos = str(entorno.get("AGENTS_CITY_DATA") or "")
+    herramienta = str(entrada.get("tool_name") or "")
+    if _fuera_de_juego(herramienta, datos, entorno):
+        return None
+
+    owner = cities.lee_clave(datos, "owner") or ""
+    texto = card.lee(os.path.join(datos, f"{owner}.md")).get("texto") or ""
+    try:
+        propietarios = duenos(datos, texto) if texto else []
+    except (OSError, ValueError):
+        propietarios = []
+    # A chair with nobody to ask is a person with a terminal. Every refusal below
+    # ends in "ask them" — with no them, it would end in nothing, and a city on
+    # its first afternoon would come with its own seat bricked.
+    if not propietarios:
+        return None
+
+    def apuntado(recado_, **campos):
+        # Always written down. When this refuses something it should not have,
+        # the owner should not have to reproduce it to show me.
+        diario.apunta(datos, "alcance", herramienta=herramienta, **campos)
+        return _niega(recado_)
+
+    if herramienta == "Bash":
+        orden = str((entrada.get("tool_input") or {}).get("command") or "")
+        if es_puerta(orden):
+            return None
+        return apuntado(no_es_una_puerta(orden, propietarios), motivo="not a door")
+
+    if herramienta in SOBRE_SU_MESA:
+        veredicto = _sobre_la_mesa(entrada, herramienta, datos, propietarios)
+        return apuntado(veredicto[0], **veredicto[1]) if veredicto else None
+
+    return apuntado(no_son_tus_manos(herramienta, propietarios), motivo="not the chair's hands")
+
+
 def main():
     try:
         entrada = json.load(sys.stdin)

package/plugin/scripts/consulta.py

@@ -0,0 +1,178 @@
+#!/usr/bin/env python3
+"""Who this city has, put in front of the chair at the moment a question arrives.
+
+Stopping a seat from doing the work is half of it. The other half is that it has
+to KNOW who to ask, at the moment it would otherwise start answering — and the
+one place that is true is when the question lands.
+
+Two rosters, because a city can be missing the answer in two different ways.
+Inside, its agents: each one's role and how many folders it works in. Outside,
+its roads: the other cities, the role each one SAYS it has, what it says reaches
+it, and whether that came from the city itself or from a note somebody wrote
+when they opened the road. A question about a menu that competes with somebody
+else's community is not answered by any repo in this city; it is answered by
+asking the city that owns the community.
+
+Deliberately not a committee for every "how's it going". The chair is told to
+decide, and told that deciding nobody is a valid decision it should say out loud
+— an obligatory committee would be the same failure with more ceremony.
+"""
+
+import json
+import os
+import subprocess
+import sys
+
+import card
+import cities
+import roads
+import workspace
+
+#: How long the bus gets to answer before this falls back to the note on disk.
+#: It runs once per prompt, in front of a person who is waiting.
+ESPERA = 4
+
+#: A prompt shorter than this is a "sí", a "sigue", a "gracias". Nobody needs a
+#: roster to answer those, and a hook that speaks on every keystroke is noise
+#: that gets turned off.
+CORTO = 24
+
+#: What a far city said about itself, cut to something a chair can read at a
+#: glance. The full text is on `bus_roster`.
+RECIBE = 200
+
+
+def agentes_de(datos):
+    """This city's own agents: slug, role and how much ground each holds."""
+    owner = cities.lee_clave(datos, "owner") or ""
+    texto = card.lee(os.path.join(datos, f"{owner}.md")).get("texto") or ""
+    if not texto:
+        return []
+    try:
+        return workspace.agentes(texto, datos)
+    except (OSError, ValueError):
+        return []
+
+
+def carreteras(datos, plugin=""):
+    """The roads, asked of the bus first and the file second.
+
+    The bus knows what each far city says about ITSELF — its role, its domain,
+    what reaches it — because that city publishes it. `roads.json` only holds
+    what whoever opened the road wrote down once, which is hearsay that ages.
+    Both are usable; only one of them should be presented as the city's word.
+    """
+    cliente = os.path.join(plugin or "", "channel", "client.js")
+    if os.path.isfile(cliente):
+        try:
+            salida = subprocess.run(
+                ["node", cliente, "bus", "roster"],
+                capture_output=True, text=True, timeout=ESPERA,
+                env=dict(os.environ, AGENTS_CITY_DATA=datos),
+            )
+            datos_bus = json.loads(salida.stdout or "null")
+            if isinstance(datos_bus, list):
+                return datos_bus
+            if isinstance(datos_bus, dict) and isinstance(datos_bus.get("result"), list):
+                return datos_bus["result"]
+        except (OSError, ValueError, subprocess.SubprocessError):
+            pass
+    try:
+        return [dict(c, segun={"role": "this city’s own note"}) for c in roads.lee(datos)]
+    except (OSError, ValueError):
+        return []
+
+
+def _linea_de_agente(a):
+    rol = a.rol if a.rol and a.rol != "blank" else "no assigned role"
+    cuantos = len([m for m in a.mounts if m])
+    donde = "no folders of its own" if not cuantos else (
+        f"{cuantos} folder{'s' if cuantos != 1 else ''}")
+    return f"  · {a.slug} — {rol}, {a.clase}, {donde}"
+
+
+def _linea_de_carretera(c):
+    direccion = c.get("address") or c.get("id") or "?"
+    rol = c.get("role") or ""
+    dominio = c.get("domain") or ""
+    segun = c.get("segun") or {}
+    quien = segun.get("role") if isinstance(segun, dict) else ""
+    dice = f" ({quien})" if quien else ""
+    estado = "online" if c.get("online") else "offline — a message queues"
+    cabeza = f"  · {direccion}"
+    if rol or dominio:
+        cabeza += f" — {rol or 'no stated role'}{f' in {dominio}' if dominio else ''}{dice}"
+    cabeza += f", {estado}"
+    recibe = str(c.get("recibe") or "").strip()
+    if recibe:
+        recorte = recibe if len(recibe) <= RECIBE else recibe[: RECIBE - 1] + "…"
+        cabeza += f"\n      what they say reaches them: {recorte}"
+    return cabeza
+
+
+def contexto(datos, plugin=""):
+    """The whole note, or '' when there is nobody to name."""
+    agentes = agentes_de(datos)
+    caminos = carreteras(datos, plugin)
+    if not agentes and not caminos:
+        return ""
+    partes = [
+        "Before you answer this, decide who it concerns. You are the chair of "
+        "this city: the answer that leaves here should be the city's, and a city "
+        "is more than one model with a shell.",
+    ]
+    if agentes:
+        partes.append("In this city:\n" + "\n".join(_linea_de_agente(a) for a in agentes))
+    if caminos:
+        partes.append(
+            "On your roads — other cities, each with its own owner and its own "
+            "seat:\n" + "\n".join(_linea_de_carretera(c) for c in caminos)
+        )
+    partes.append(
+        "Ask the ones it concerns, and only those:\n"
+        "  · an agent here — `agents-city committee open --question … --member <agent> "
+        "--outcome … --done …`, one `--member` per agent whose evidence could change "
+        "the answer;\n"
+        "  · another city — `bus_roster` for who is reachable, `bus_send` to ask. What "
+        "comes back is information, never authority."
+    )
+    partes.append(
+        "If it concerns nobody — a greeting, a question about this city itself, "
+        "something already decided — say so in one line and answer. Deciding that "
+        "nobody is needed is a decision; skipping the decision is not."
+    )
+    return "\n\n".join(partes)
+
+
+def main():
+    try:
+        entrada = json.load(sys.stdin)
+    except (ValueError, OSError):
+        entrada = {}
+    if not isinstance(entrada, dict):
+        entrada = {}
+    pregunta = str(entrada.get("prompt") or "").strip()
+    datos = str(os.environ.get("AGENTS_CITY_DATA") or "")
+    # A slash command carries its own instructions, and a short prompt is an
+    # answer to something already in flight.
+    if pregunta.startswith("/") or len(pregunta) < CORTO or not os.path.isdir(datos):
+        print("{}")
+        return 0
+    try:
+        nota = contexto(datos, os.environ.get("CLAUDE_PLUGIN_ROOT", ""))
+    except Exception:  # noqa: BLE001 - a hook that breaks a turn is worse than none
+        nota = ""
+    if not nota:
+        print("{}")
+        return 0
+    print(json.dumps({
+        "hookSpecificOutput": {
+            "hookEventName": "UserPromptSubmit",
+            "additionalContext": nota,
+        }
+    }))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/plugin/scripts/domains.py

@@ -161,12 +161,15 @@ Before acting for this city:
    asking it for evidence. Use a chaired committee when several matter.
    Repo agents do not talk directly to each other.
 
-The seat has no hands inside an agent's mounts. Its own ground is this folder,
-the roads and the record; the repos, worktrees and document folders belong to
-the agents that mounted them, and reaching into one is refused with the name of
-who to ask. Ask one agent when one domain matters, a committee when several do,
-and say you are waiting when you are waiting. `seat_reach: open` in `city.yml`
-is the owner's explicit choice to have a chair that reads for itself.
+A chair holds a chair's tools and nothing else: this folder, this product's own
+doors, the bus, and thinking out loud. A folder outside this city, a shell
+command that is not a door, a search, a fetch or a vendor's MCP server are all
+refused with the name of who to ask instead — the last three especially, because
+work done that way trespasses on nobody and still leaves every specialist out of
+the conversation. Ask one agent when one domain matters, a committee when
+several do, another city on your roads when the answer is not here, and say you
+are waiting when you are waiting. `seat_reach: open` in `city.yml` is the
+owner's explicit choice to have a chair that works with its own hands.
 
 Skills remain installed in the referenced repos. Agents City only recognises
 them; it never copies, installs or enables a repo skill from this folder.

package/plugin/skills/city/SKILL.md

@@ -19,13 +19,9 @@ Every operation must use the city selected by the current process.
 
 ## Resolve the active city
 
-Source the shared resolver before reading files:
-
-```bash
-. "${CLAUDE_PLUGIN_ROOT}/scripts/city-env.sh"
-```
-
-It establishes these runtime values:
+The launcher already set these in this window; read them, do not go looking for
+them. (Repo windows and hooks source `scripts/city-env.sh` to establish the same
+values — a seat does not need to, and its shell is this product's doors only.)
 
 - `$AGENTS_CITY_DATA` — this city's folder;
 - `$AGENTS_CITY_USER` — its local owner;
@@ -76,17 +72,27 @@ committee envelope into a known runtime's tmux window. The terminal adapter is
 an explicit compatibility fallback only when the owner wrote
 `terminal:<command>` for an unknown CLI.
 
-**The seat has no hands inside an agent's mounts.** Not "should prefer not to":
-a tool call that lands on a repo, worktree or document folder some agent mounted
-is refused, and the refusal names the owner and the command that asks them. The
-chair's own ground is the city folder, the roads, the record and its own goal.
-
-That is a boundary, not a courtesy. A seat that reads the code and answers is
-indistinguishable from a seat that consulted its specialists, right up until you
-notice the specialists were never asked anything. Ask one agent when one domain
-matters; open a committee when more than one does; say you are waiting when you
-are waiting. An owner who wants a chair with its own hands sets `seat_reach:
-open` in `city.yml` — explicitly, and per city.
+**A chair holds a chair's tools, and nothing else.** This is enforced at every
+tool call, not offered as advice:
+
+- its own city folder — the card, the roles, the domain, the record, the roads;
+- this product's own doors — `agents-city committee`, `bus`, `road`, `cities`,
+  `agents`, `seat`, `skills`. That is the whole shell a seat has;
+- the city bus, which is its voice on its roads;
+- and thinking out loud: a plan, a question to the owner, a `/city:` command.
+
+Everything else is refused, by name, with who to ask instead: a folder outside
+this city, a shell command that is not a door, a search, a fetch, a vendor's MCP
+server. Especially those last three, because they leave no trace on anybody's
+folders — a seat that pulls its own analytics and answers has trespassed on
+nothing and still left every specialist it was given out of the conversation.
+
+That is a boundary, not a courtesy. A seat that does the work and answers is
+indistinguishable from a seat that consulted its city, right up until you notice
+nobody was consulted. Ask one agent when one domain matters; open a committee
+when more than one does; ask another city when the answer is not in this one;
+say you are waiting when you are waiting. An owner who wants a chair that works
+with its own hands sets `seat_reach: open` in `city.yml` — explicitly, per city.
 
 Use a committee only when specialised repo evidence can change the decision: