@kigo-dev/sindri 0.1.4 → 0.1.5

package/dist/index.js

@@ -3262,8 +3262,8 @@ var require_utils = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path10) {
-      let input2 = path10;
+    function removeDotSegments(path11) {
+      let input2 = path11;
       const output2 = [];
       let nextSlash = -1;
       let len = 0;
@@ -3672,8 +3672,8 @@ var require_schemes = __commonJS({
       }
       if (wsComponent.resourceName) {
         const queryIndex = wsComponent.resourceName.indexOf("?");
-        const path10 = queryIndex === -1 ? wsComponent.resourceName : wsComponent.resourceName.slice(0, queryIndex);
-        wsComponent.path = path10 && path10 !== "/" ? path10 : void 0;
+        const path11 = queryIndex === -1 ? wsComponent.resourceName : wsComponent.resourceName.slice(0, queryIndex);
+        wsComponent.path = path11 && path11 !== "/" ? path11 : void 0;
         wsComponent.query = queryIndex === -1 ? void 0 : wsComponent.resourceName.slice(queryIndex + 1);
         wsComponent.resourceName = void 0;
       }
@@ -3732,7 +3732,7 @@ var require_schemes = __commonJS({
       urnComponent.nss = (uuidComponent.uuid || "").toLowerCase();
       return urnComponent;
     }
-    var http2 = (
+    var http3 = (
       /** @type {SchemeHandler} */
       {
         scheme: "http",
@@ -3745,7 +3745,7 @@ var require_schemes = __commonJS({
       /** @type {SchemeHandler} */
       {
         scheme: "https",
-        domainHost: http2.domainHost,
+        domainHost: http3.domainHost,
         parse: httpParse,
         serialize: httpSerialize
       }
@@ -3789,7 +3789,7 @@ var require_schemes = __commonJS({
     var SCHEMES = (
       /** @type {Record<SchemeName, SchemeHandler>} */
       {
-        http: http2,
+        http: http3,
         https,
         ws,
         wss,
@@ -7185,12 +7185,12 @@ var require_dist = __commonJS({
         throw new Error(`Unknown format "${name}"`);
       return f;
     };
-    function addFormats(ajv, list, fs10, exportName) {
+    function addFormats(ajv, list, fs11, exportName) {
       var _a3;
       var _b;
       (_a3 = (_b = ajv.opts.code).formats) !== null && _a3 !== void 0 ? _a3 : _b.formats = (0, codegen_1._)`require("ajv-formats/dist/formats").${exportName}`;
       for (const f of list)
-        ajv.addFormat(f, fs10[f]);
+        ajv.addFormat(f, fs11[f]);
     }
     module.exports = exports = formatsPlugin;
     Object.defineProperty(exports, "__esModule", { value: true });
@@ -7572,8 +7572,8 @@ function getErrorMap() {
 
 // node_modules/.pnpm/zod@4.5.4/node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
-  const { data, path: path10, errorMaps, issueData } = params;
-  const fullPath = [...path10, ...issueData.path || []];
+  const { data, path: path11, errorMaps, issueData } = params;
+  const fullPath = [...path11, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -7688,11 +7688,11 @@ var errorUtil;
 
 // node_modules/.pnpm/zod@4.5.4/node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
-  constructor(parent, value, path10, key) {
+  constructor(parent, value, path11, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value;
-    this._path = path10;
+    this._path = path11;
     this._key = key;
   }
   get path() {
@@ -11580,10 +11580,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path10) {
-  if (!path10)
+function getElementAtPath(obj, path11) {
+  if (!path11)
     return obj;
-  return path10.reduce((acc, key) => acc?.[key], obj);
+  return path11.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -11995,11 +11995,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path10, issues) {
+function prefixIssues(path11, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path10);
+    iss.path.unshift(path11);
     return iss;
   });
 }
@@ -12432,16 +12432,16 @@ function flattenError(error61, mapper = (issue2) => issue2.message) {
 }
 function formatError(error61, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error62, path10 = []) => {
+  const processError = (error62, path11 = []) => {
     for (const issue2 of error62.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path10, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path11, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path10, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path11, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path10, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path11, ...issue2.path]);
       } else {
-        const fullpath = [...path10, ...issue2.path];
+        const fullpath = [...path11, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -12480,17 +12480,17 @@ function formatError(error61, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error61, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error62, path10 = []) => {
+  const processError = (error62, path11 = []) => {
     var _a3;
     for (const issue2 of error62.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path10, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path11, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path10, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path11, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path10, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path11, ...issue2.path]);
       } else {
-        const fullpath = [...path10, ...issue2.path];
+        const fullpath = [...path11, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -12529,8 +12529,8 @@ function treeifyError(error61, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path10 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path10) {
+  const path11 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path11) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -27511,11 +27511,11 @@ function normalizeObjectSchema(schema) {
   }
   return void 0;
 }
-function getDotPath(path10) {
-  if (path10.length === 0) {
+function getDotPath(path11) {
+  if (path11.length === 0) {
     return "object root";
   }
-  return path10.reduce((acc, seg, index) => {
+  return path11.reduce((acc, seg, index) => {
     if (index === 0) {
       return String(seg);
     }
@@ -29678,13 +29678,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path10 = ref.slice(1).split("/").filter(Boolean);
-  if (path10.length === 0) {
+  const path11 = ref.slice(1).split("/").filter(Boolean);
+  if (path11.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path10[0] === defsKey) {
-    const key = path10[1] === void 0 ? void 0 : decodeJSONPointerSegment(path10[1]);
+  if (path11[0] === defsKey) {
+    const key = path11[1] === void 0 ? void 0 : decodeJSONPointerSegment(path11[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -35962,29 +35962,33 @@ function appRoot(cfg, name) {
 }
 
 // src/instructions.ts
-var INSTRUCTIONS = `You are helping a Kigo product manager (PM) build small internal apps with Sindri. The PM is not technical: they never see code, git, terminals or ports. You write the code in the app folder on their computer; the sindri tools install, preview, publish and keep versions.
+var INSTRUCTIONS = `You are helping a person at Kigo build small internal apps with Sindri. Call them the builder: anyone in the company (product, operations, CX, finance, a developer). Assume they are not technical unless they show otherwise: they never see code, git, terminals or ports. You write the code in the app folder on their computer; the sindri tools install, preview, publish and keep versions.
 
-Language and tone: always Spanish, "t\xFA", short sentences. Say "app" (feminine: "la app", "tu app"), never "herramienta", "proyecto", "repo", "deploy" or "build". Never paste file paths, commands, logs or stack traces; summarize in one line what happened and what you will do. The \`summary\` field of every tool result is written for the PM: repeat it as is or paraphrase it.
+Language and tone: always Spanish, "t\xFA", short sentences. Say "app" (feminine: "la app", "tu app"), never "herramienta", "proyecto", "repo", "deploy" or "build". Never paste file paths, commands, logs or stack traces; summarize in one line what happened and what you will do. The \`summary\` field of every tool result is written for the builder: repeat it as is or paraphrase it.
 
-First contact: the first time the PM speaks in a conversation, or whenever they ask what Sindri is or can do, call \`help\` and relay its \`summary\` (that is the introduction: what Sindri is, what they can ask for, the limits, the link to Mi espacio), then ask what they want to build. Do not repeat it later in the same conversation. When the PM asks where to see their apps or their versions, give them the Mi espacio link (\`space_url\`, https://sindri.kigo.dev).
+First contact: the first time the builder speaks in a conversation, or whenever they ask what Sindri is or can do, call \`help\` and relay its \`summary\` (that is the introduction: what Sindri is, what they can ask for, the limits, the link to Mi espacio), then ask what they want to build. Do not repeat it later in the same conversation. When the builder asks where to see their apps or their versions, give them the Mi espacio link (\`space_url\`, https://sindri.kigo.dev).
 
 Flow:
-1. First time on a machine: run \`setup\` (installs Node and pnpm without admin rights) and \`login\` (opens the browser on Kigo's sign-in page; the PM enters with their @cargomovil.com Google account and the browser comes back on its own with "Listo, ya entraste a Sindri"; tell them to return to Claude). \`login\` waits up to five minutes. If any tool answers \`needs_setup\` or \`needs_login\`, run that tool and retry once.
-2. New app: ask at most one question if the request is vague (for whom, what it must show), then \`create_app\` with a short lowercase name (it becomes the address https://<name>.sindri.kigo.dev) and a one-sentence description in Spanish. Then edit the files in the folder the tool returns to build what the PM asked. The template is Next.js + Drizzle; read its CLAUDE.md first; keep the UI in Spanish, "t\xFA", with the Kigo components it ships.
-3. Show before shipping: run \`preview\` and tell the PM to look at the local address; ask what to change. Edits reload live.
-4. Ship: \`publish\` with a message in the PM's words ("Filtro por fecha"). Give the URL and say the team enters with their Google de Kigo. If publish fails, the published version did not change: say what broke in one line, fix it, publish again. The published app has its own database: publish runs the migrations and, when this version changed drizzle/ or src/db/seed.ts, loads the test data again; rows the PM typed into the local preview never travel. Keep test data in the seed, not in the UI.
-5. Later: \`status\` before working on an existing app (tells you whether the local folder is behind or has unpublished edits); \`versions\` and \`rollback\` when the PM wants "como estaba ayer"; \`share\` for the Slack line.
-6. Template updates: when the PM says "actualiza la plantilla" or Sindri announces a template fix, run \`update_template\`. It replaces only the files the app never customised, publishes \xABPlantilla actualizada\xBB and brings the local folder to it; the files you had changed are listed in \`skipped\` so you can apply the same change there by hand if it matters. It refuses while there are unpublished local edits: publish them first (or tell the PM what would be lost) and retry.
-7. Renaming: an app has an address (https://<name>.sindri.kigo.dev) and a visible name (the title people see). When the PM says "c\xE1mbiale el nombre" and it is not obvious which one they mean, ask: "\xBFla direcci\xF3n o el nombre que se ve?". \`rename_app\` with \`new_name\` changes the address (Sindri renames it, the local folder follows, the old link stops working: tell the PM to share the new one); it refuses while there are unpublished edits, so publish first. \`rename_app\` with \`display_name\` changes only the visible name and publishes it as \xABAhora se llama \xAB<nombre>\xBB\xBB. Both in one call is fine.
-8. Deleting: \`delete_app\` is final in Sindri (address, versions, database). Before calling it, ask the PM to type the app's name to confirm and pass exactly what they wrote as \`confirm\`; never fill it in yourself, never guess it, never call it because you inferred they want it. The local files are moved to the Sindri papelera on their computer, not deleted; say so.
+1. First time on a machine: run \`setup\` (installs Node and pnpm without admin rights) and \`login\` (opens the browser on Kigo's sign-in page; the builder enters with their @cargomovil.com Google account and the browser comes back on its own with "Listo, ya entraste a Sindri"; tell them to return to Claude). \`login\` waits up to five minutes. If any tool answers \`needs_setup\` or \`needs_login\`, run that tool and retry once.
+2. New app: ask at most one question if the request is vague (for whom, what it must show), then \`create_app\` with a short lowercase name (it becomes the address https://<name>.sindri.kigo.dev) and a one-sentence description in Spanish. Then edit the files in the folder the tool returns to build what the builder asked. The template is Next.js + Drizzle; read its CLAUDE.md first; keep the UI in Spanish, "t\xFA", with the Kigo components it ships.
+3. Show before shipping: run \`preview\` and tell the builder to look at the local address; ask what to change. Edits reload live.
+4. Ship: \`publish\` with a message in the builder's words ("Filtro por fecha"). Give the URL and say the team enters with their Google de Kigo. If publish fails, the published version did not change: say what broke in one line, fix it, publish again. The published app has its own database: publish runs the migrations and, when this version changed drizzle/ or src/db/seed.ts, loads the test data again; rows the builder typed into the local preview never travel. Keep test data in the seed, not in the UI.
+5. Later: \`status\` before working on an existing app (tells you whether the local folder is behind or has unpublished edits); \`versions\` and \`rollback\` when the builder wants "como estaba ayer"; \`share\` for the Slack line.
+6. Template updates: when the builder says "actualiza la plantilla" or Sindri announces a template fix, run \`update_template\`. It replaces only the files the app never customised, publishes \xABPlantilla actualizada\xBB and brings the local folder to it; the files you had changed are listed in \`skipped\` so you can apply the same change there by hand if it matters. It refuses while there are unpublished local edits: publish them first (or tell the builder what would be lost) and retry.
+7. Renaming: an app has an address (https://<name>.sindri.kigo.dev) and a visible name (the title people see). When the builder says "c\xE1mbiale el nombre" and it is not obvious which one they mean, ask: "\xBFla direcci\xF3n o el nombre que se ve?". \`rename_app\` with \`new_name\` changes the address (Sindri renames it, the local folder follows, the old link stops working: tell the builder to share the new one); it refuses while there are unpublished edits, so publish first. \`rename_app\` with \`display_name\` changes only the visible name and publishes it as \xABAhora se llama \xAB<nombre>\xBB\xBB. Both in one call is fine.
+8. Deleting: \`delete_app\` is final in Sindri (address, versions, database). Before calling it, ask the builder to type the app's name to confirm and pass exactly what they wrote as \`confirm\`; never fill it in yourself, never guess it, never call it because you inferred they want it. The local files are moved to the Sindri papelera on their computer, not deleted; say so.
 
-Design guide: before creating or changing any page, component, layout, style or copy, call \`design_guide\` for the app, first without \`topic\` (the overview and the list of topics), then with the topic that matches what you are building (admin, landing, mini-app, mobile; tokens, writing and checklist when relevant). Follow it; it is for you, never paste its content to the PM. If it answers \`no_design_guide\`, run \`update_template\` once and call \`design_guide\` again.
+Secrets: when the app needs a credential (an API key, a token, a password for another service), never ask the builder to paste it in the chat and never write it in code, seeds or comments. Call \`set_secret\` with the variable name (UPPER_SNAKE_CASE, e.g. LINEAR_API_KEY) and a one-line \`hint\` in Spanish saying what to paste; tell the builder "se abri\xF3 una p\xE1gina en tu navegador para pegarlo" and wait: the tool returns when they saved it (or after five minutes). The value is stored in the app's .env.local on their computer and in Sindri; the running preview restarts so the code sees it. In code read it as \`process.env.NAME\` (server side only: route handlers, server components, server actions) and handle the missing case with a clear Spanish message. \`list_secrets\` tells you which names exist on each side (never values); \`delete_secret\` removes one after the builder agrees. Never read .env.local (or any .env* file) and never repeat its contents to the builder, not even partially.
 
-Rules: synthetic data only (never paste real emails, plates or phone numbers into seeds); one author per app (the PM); never touch files outside the app folder; do not edit middleware.ts, next.config.ts or package.json scripts (publish will refuse them); apps work Monday to Friday 9:05 am to midnight Mexico City time and the link says so outside those hours. When something fails, explain in one line what to do next; never blame the PM.`;
+Tasks: when something must happen on its own on a schedule (sync data from another service, send a summary, recompute a table), declare it in kigo-app.yaml with ONE line \`schedules: [{"name":"sync-linear","path":"/api/tareas/sync-linear","every":"30m"}]\` (a JSON list: \`name\` lowercase with hyphens and unique, \`path\` under /api/ without query, \`every\` one of 5m, 10m, 15m, 30m, 1h, 2h, 6h, 12h, 1d; at most 5 tasks). The route at that path must be built with the template's \`taskHandler(name, fn)\` from src/lib/tasks.ts (see the app's CLAUDE.md and the design guide topic tasks-and-secrets): it only accepts the platform's signed calls, so never call it from the UI. Test it with \`run_task\` locally (preview running) before publishing, then \`run_task\` with \`where: "sindri"\` once published; \`status\` shows the last run of each task. Remind the builder that in Sindri tasks run only in business hours (Monday to Friday, 9:05 am to midnight, Mexico City), never on weekends or at night.
+
+Design guide: before creating or changing any page, component, layout, style or copy, call \`design_guide\` for the app, first without \`topic\` (the overview and the list of topics), then with the topic that matches what you are building (admin, landing, mini-app, mobile; tokens, writing and checklist when relevant). Follow it; it is for you, never paste its content to the builder. If it answers \`no_design_guide\`, run \`update_template\` once and call \`design_guide\` again.
+
+Rules: synthetic data only (never paste real emails, plates or phone numbers into seeds); one author per app (the builder); never touch files outside the app folder; never read .env.local back to the builder; do not edit middleware.ts, next.config.ts or package.json scripts (publish will refuse them); apps work Monday to Friday 9:05 am to midnight Mexico City time and the link says so outside those hours. When something fails, explain in one line what to do next; never blame the builder.`;
 
 // src/tools.ts
-import fs9 from "node:fs/promises";
-import path9 from "node:path";
+import fs10 from "node:fs/promises";
+import path10 from "node:path";
 
 // src/api.ts
 import fs3 from "node:fs/promises";
@@ -36367,6 +36371,20 @@ var ApiClient = class {
   share(name) {
     return this.json("GET", `/v1/apps/${enc(name)}/share`);
   }
+  listSecrets(name) {
+    return this.json("GET", `/v1/apps/${enc(name)}/secrets`).then((r) => r.names ?? []);
+  }
+  /** Stores one secret in the app's workspace; `restarted` says whether the app was restarted to pick it up. */
+  putSecret(name, key, value) {
+    return this.json("PUT", `/v1/apps/${enc(name)}/secrets/${enc(key)}`, { value }, 12e4);
+  }
+  deleteSecret(name, key) {
+    return this.json("DELETE", `/v1/apps/${enc(name)}/secrets/${enc(key)}`, void 0, 12e4);
+  }
+  /** Runs a declared task now in the workspace and waits for it (the router caps the run). */
+  runTask(name, task) {
+    return this.json("POST", `/v1/apps/${enc(name)}/tasks/${enc(task)}/run`, {}, 32e4);
+  }
   /** Downloads an archive (`archive_url` from create, or /archive of a version) to a temp file. */
   async download(urlOrPath, version2) {
     const u = new URL(urlOrPath.startsWith("http") ? urlOrPath : `${this.cfg.apiUrl}${urlOrPath}`);
@@ -36423,22 +36441,126 @@ function enc(name) {
   return encodeURIComponent(name);
 }
 
-// src/layout.ts
+// src/envfile.ts
+import { randomBytes as randomBytes2 } from "node:crypto";
 import fs4 from "node:fs/promises";
 import path4 from "node:path";
+var ENV_FILE = ".env.local";
+var PLATFORM_KEYS = ["KIGO_ENV", "KIGO_APP_NAME", "DATABASE_URL", "PGLITE_DATA_DIR", "SINDRI_TASK_TOKEN"];
+var SECRET_NAME_RE = /^[A-Z][A-Z0-9_]{1,63}$/;
+function validSecretName(name) {
+  return typeof name === "string" && SECRET_NAME_RE.test(name);
+}
+function reservedKey(name) {
+  return PLATFORM_KEYS.includes(name);
+}
+var LINE_RE = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=(.*)$/;
+function envKeys(text) {
+  const out = [];
+  for (const line of text.split("\n")) {
+    const m = LINE_RE.exec(line);
+    if (m?.[1] && !out.includes(m[1])) out.push(m[1]);
+  }
+  return out;
+}
+function envValue(text, key) {
+  for (const line of text.split("\n")) {
+    const m = LINE_RE.exec(line);
+    if (!m || m[1] !== key) continue;
+    const raw = (m[2] ?? "").trim();
+    const q = raw[0];
+    if ((q === '"' || q === "'" || q === "`") && raw.length >= 2) {
+      const end = raw.indexOf(q, 1);
+      const inner = end > 0 ? raw.slice(1, end) : raw.slice(1);
+      return q === '"' ? inner.replace(/\\n/g, "\n") : inner;
+    }
+    return raw.replace(/\s+#.*$/, "").trim();
+  }
+  return void 0;
+}
+function envLine(key, value) {
+  return `${key}=${quoteEnvValue(value)}`;
+}
+function quoteEnvValue(value) {
+  if (value !== "" && /^[A-Za-z0-9_.\/:@+=,\-]+$/.test(value)) return value;
+  const order = value.includes("$") ? ["'", '"', "`"] : ['"', "'", "`"];
+  for (const q of order) {
+    if (value.includes(q)) continue;
+    if (q === '"') return `"${value.replace(/\r?\n/g, "\\n")}"`;
+    if (value.includes("\n")) continue;
+    return `${q}${value}${q}`;
+  }
+  throw new Error("value cannot be quoted for .env.local");
+}
+function upsertEnv(text, key, value) {
+  const line = envLine(key, value);
+  const lines = text.split("\n");
+  const hadTrailing = lines.at(-1) === "";
+  if (hadTrailing) lines.pop();
+  let done = false;
+  const out = [];
+  for (const l of lines) {
+    if (LINE_RE.exec(l)?.[1] === key) {
+      if (!done) out.push(line);
+      done = true;
+      continue;
+    }
+    out.push(l);
+  }
+  if (!done) out.push(line);
+  return `${out.join("\n")}
+`;
+}
+function removeEnv(text, key) {
+  const lines = text.split("\n");
+  const hadTrailing = lines.at(-1) === "";
+  if (hadTrailing) lines.pop();
+  const out = lines.filter((l) => LINE_RE.exec(l)?.[1] !== key);
+  return out.length === 0 ? "" : `${out.join("\n")}
+`;
+}
+function newTaskToken() {
+  return randomBytes2(32).toString("hex");
+}
+function envFile(appDir) {
+  return path4.join(appDir, ENV_FILE);
+}
+async function readEnvFile(appDir) {
+  return fs4.readFile(envFile(appDir), "utf8").catch(() => "");
+}
+async function writeEnvFile(appDir, text) {
+  await fs4.writeFile(envFile(appDir), text, { mode: 384 });
+}
+async function ensureLocalEnv(appDir, app) {
+  const before = await readEnvFile(appDir);
+  let text = before;
+  if (envValue(text, "KIGO_ENV") === void 0) text = upsertEnv(text, "KIGO_ENV", "local");
+  if (envValue(text, "KIGO_APP_NAME") === void 0) text = upsertEnv(text, "KIGO_APP_NAME", app);
+  const createdToken = !envValue(text, "SINDRI_TASK_TOKEN");
+  if (createdToken) text = upsertEnv(text, "SINDRI_TASK_TOKEN", newTaskToken());
+  if (text !== before) await writeEnvFile(appDir, text);
+  return { created_token: createdToken };
+}
+function secretKeys(text) {
+  return envKeys(text).filter((k) => !reservedKey(k));
+}
+
+// src/layout.ts
+import fs5 from "node:fs/promises";
+import path5 from "node:path";
 async function appPaths(cfg, name, ownerHint) {
   const root = appRoot(cfg, name);
   const discovered = await ownerFromApps(root, name);
   const owner = discovered ?? ownerHint ?? await cachedOwner(cfg) ?? "";
-  return { root, appDir: owner ? path4.join(root, "apps", owner, name) : path4.join(root, "apps", "_", name), owner };
+  return { root, appDir: owner ? path5.join(root, "apps", owner, name) : path5.join(root, "apps", "_", name), owner };
 }
 async function ownerFromApps(root, name) {
   try {
-    const owners = (await fs4.readdir(path4.join(root, "apps"), { withFileTypes: true })).filter((e) => e.isDirectory() && !e.name.startsWith("."));
+    const owners = (await fs5.readdir(path5.join(root, "apps"), { withFileTypes: true })).filter((e) => e.isDirectory() && !e.name.startsWith("."));
     const withApp = [];
     for (const o of owners) {
       try {
-        await fs4.access(path4.join(root, "apps", o.name, name, "package.json"));
+        await fs5.access(path5.join(root, "apps", o.name, name, "package.json"));
         withApp.push(o.name);
       } catch {
       }
@@ -36451,15 +36573,15 @@ async function ownerFromApps(root, name) {
   }
 }
 function meFile(cfg) {
-  return path4.join(cfg.stateDir, "me.json");
+  return path5.join(cfg.stateDir, "me.json");
 }
 async function rememberMe(cfg, me) {
-  await fs4.mkdir(cfg.stateDir, { recursive: true, mode: 448 });
-  await fs4.writeFile(meFile(cfg), JSON.stringify(me), { mode: 384 });
+  await fs5.mkdir(cfg.stateDir, { recursive: true, mode: 448 });
+  await fs5.writeFile(meFile(cfg), JSON.stringify(me), { mode: 384 });
 }
 async function cachedOwner(cfg) {
   try {
-    const me = JSON.parse(await fs4.readFile(meFile(cfg), "utf8"));
+    const me = JSON.parse(await fs5.readFile(meFile(cfg), "utf8"));
     return me.owner || null;
   } catch {
     return null;
@@ -36467,63 +36589,79 @@ async function cachedOwner(cfg) {
 }
 async function appPresent(p) {
   try {
-    await fs4.access(path4.join(p.appDir, "package.json"));
+    await fs5.access(path5.join(p.appDir, "package.json"));
     return true;
   } catch {
     return false;
   }
 }
-var DESIGN_GUIDE_REL = path4.join(".claude", "skills", "kigo-sindri-design");
+var DESIGN_GUIDE_REL = path5.join(".claude", "skills", "kigo-sindri-design");
 async function readDesignGuide(p, topic) {
-  const dir = path4.join(p.appDir, DESIGN_GUIDE_REL);
+  const dir = path5.join(p.appDir, DESIGN_GUIDE_REL);
   let skill;
   try {
-    skill = await fs4.readFile(path4.join(dir, "SKILL.md"), "utf8");
+    skill = await fs5.readFile(path5.join(dir, "SKILL.md"), "utf8");
   } catch {
     return null;
   }
   const topics = await designTopics(dir);
   if (topic === void 0) return { content: skill, topics };
   if (!topics.includes(topic)) return { unknown: true, topics };
-  return { content: await fs4.readFile(path4.join(dir, "references", `${topic}.md`), "utf8"), topics };
+  return { content: await fs5.readFile(path5.join(dir, "references", `${topic}.md`), "utf8"), topics };
 }
 async function designTopics(dir) {
   try {
-    const entries = await fs4.readdir(path4.join(dir, "references"), { withFileTypes: true });
+    const entries = await fs5.readdir(path5.join(dir, "references"), { withFileTypes: true });
     return entries.filter((e) => e.isFile() && e.name.endsWith(".md") && !e.name.startsWith(".")).map((e) => e.name.slice(0, -".md".length)).sort();
   } catch {
     return [];
   }
 }
 async function linkDesignGuide(p) {
-  const target = path4.join(p.appDir, DESIGN_GUIDE_REL);
+  const target = path5.join(p.appDir, DESIGN_GUIDE_REL);
   try {
-    if (!(await fs4.stat(target)).isDirectory()) return false;
+    if (!(await fs5.stat(target)).isDirectory()) return false;
   } catch {
     return false;
   }
-  const link = path4.join(p.root, DESIGN_GUIDE_REL);
-  const rel = path4.relative(path4.dirname(link), target);
-  for (const parent of [path4.join(p.root, ".claude"), path4.dirname(link)]) {
-    const st = await fs4.lstat(parent).catch(() => null);
+  const link = path5.join(p.root, DESIGN_GUIDE_REL);
+  const rel = path5.relative(path5.dirname(link), target);
+  for (const parent of [path5.join(p.root, ".claude"), path5.dirname(link)]) {
+    const st = await fs5.lstat(parent).catch(() => null);
     if (st && !st.isDirectory()) return false;
   }
-  const existing = await fs4.lstat(link).catch(() => null);
+  const existing = await fs5.lstat(link).catch(() => null);
   if (existing) {
     if (!existing.isSymbolicLink()) return false;
-    if (await fs4.readlink(link) === rel) return true;
-    await fs4.unlink(link);
+    if (await fs5.readlink(link) === rel) return true;
+    await fs5.unlink(link);
   }
-  await fs4.mkdir(path4.dirname(link), { recursive: true });
-  await fs4.symlink(rel, link, "dir");
+  await fs5.mkdir(path5.dirname(link), { recursive: true });
+  await fs5.symlink(rel, link, "dir");
   return true;
 }
 
 // src/manifest.ts
-import fs5 from "node:fs/promises";
-import path5 from "node:path";
+import fs6 from "node:fs/promises";
+import path6 from "node:path";
 var MANIFEST_FILE = "kigo-app.yaml";
 var KEY_RE = /^([a-z_]+):\s*(.*)$/;
+function manifestValue(text, key) {
+  for (const line of text.split("\n")) {
+    const m = KEY_RE.exec(line);
+    if (!m || m[1] !== key) continue;
+    const raw = (m[2] ?? "").trim();
+    if (raw.startsWith('"')) {
+      try {
+        return JSON.parse(raw);
+      } catch {
+        return raw.slice(1, -1);
+      }
+    }
+    return raw;
+  }
+  return void 0;
+}
 function setManifestValue(text, key, value) {
   const line = `${key}: ${JSON.stringify(value)}`;
   const lines = text.split("\n");
@@ -36537,29 +36675,29 @@ function setManifestValue(text, key, value) {
   return lines.join("\n");
 }
 async function readManifest(appDir) {
-  return fs5.readFile(path5.join(appDir, MANIFEST_FILE), "utf8").catch(() => "");
+  return fs6.readFile(path6.join(appDir, MANIFEST_FILE), "utf8").catch(() => "");
 }
 async function writeManifestValue(appDir, key, value) {
   const text = await readManifest(appDir);
-  await fs5.writeFile(path5.join(appDir, MANIFEST_FILE), setManifestValue(text, key, value));
+  await fs6.writeFile(path6.join(appDir, MANIFEST_FILE), setManifestValue(text, key, value));
 }
 
 // src/preview.ts
-import fs7 from "node:fs/promises";
+import fs8 from "node:fs/promises";
 import net from "node:net";
-import path7 from "node:path";
+import path8 from "node:path";
 
 // src/toolchain.ts
-import fs6 from "node:fs/promises";
-import path6 from "node:path";
+import fs7 from "node:fs/promises";
+import path7 from "node:path";
 var MIN_NODE = 20;
 var PNPM_ARGS = ["--config.verify-deps-before-run=false"];
 async function resolveToolchain(cfg, env = process.env) {
   const fnmBin = await fnmDefaultBin(cfg);
   if (fnmBin) {
-    const childEnv2 = { ...env, PATH: `${fnmBin}${path6.delimiter}${env.PATH ?? ""}`, COREPACK_ENABLE_DOWNLOAD_PROMPT: "0", npm_config_verify_deps_before_run: "false" };
-    const node2 = path6.join(fnmBin, "node");
-    const pnpm = path6.join(fnmBin, "pnpm");
+    const childEnv2 = { ...env, PATH: `${fnmBin}${path7.delimiter}${env.PATH ?? ""}`, COREPACK_ENABLE_DOWNLOAD_PROMPT: "0", npm_config_verify_deps_before_run: "false" };
+    const node2 = path7.join(fnmBin, "node");
+    const pnpm = path7.join(fnmBin, "pnpm");
     if (await versionOf(node2, childEnv2) >= MIN_NODE && await ok(pnpm, childEnv2)) {
       return { nodeBin: fnmBin, node: node2, pnpm, env: childEnv2, source: "fnm" };
     }
@@ -36567,20 +36705,20 @@ async function resolveToolchain(cfg, env = process.env) {
   const childEnv = { ...env, COREPACK_ENABLE_DOWNLOAD_PROMPT: "0", npm_config_verify_deps_before_run: "false" };
   if (await versionOf("node", childEnv) >= MIN_NODE && await ok("pnpm", childEnv)) {
     const which = await run("node", ["-e", "process.stdout.write(process.execPath)"], { env: childEnv, timeoutMs: 1e4 });
-    return { nodeBin: path6.dirname(which.stdout || "node"), node: "node", pnpm: "pnpm", env: childEnv, source: "path" };
+    return { nodeBin: path7.dirname(which.stdout || "node"), node: "node", pnpm: "pnpm", env: childEnv, source: "path" };
   }
   return null;
 }
 async function fnmDefaultBin(cfg) {
-  const def = path6.join(cfg.fnmDir, "aliases", "default", "bin");
-  if (await exists(path6.join(def, "node"))) return def;
-  const versions = path6.join(cfg.fnmDir, "node-versions");
+  const def = path7.join(cfg.fnmDir, "aliases", "default", "bin");
+  if (await exists(path7.join(def, "node"))) return def;
+  const versions = path7.join(cfg.fnmDir, "node-versions");
   try {
-    const names = (await fs6.readdir(versions)).filter((n) => n.startsWith("v")).sort(compareVersions);
+    const names = (await fs7.readdir(versions)).filter((n) => n.startsWith("v")).sort(compareVersions);
     const newest = names[names.length - 1];
     if (!newest) return null;
-    const bin = path6.join(versions, newest, "installation", "bin");
-    return await exists(path6.join(bin, "node")) ? bin : null;
+    const bin = path7.join(versions, newest, "installation", "bin");
+    return await exists(path7.join(bin, "node")) ? bin : null;
   } catch {
     return null;
   }
@@ -36605,7 +36743,7 @@ function compareVersions(a, b) {
 }
 async function exists(p) {
   try {
-    await fs6.access(p);
+    await fs7.access(p);
     return true;
   } catch {
     return false;
@@ -36623,42 +36761,42 @@ async function setupToolchain(cfg, opts = {}) {
   }
   const node2 = (await run(tc.node, ["--version"], { env: tc.env, timeoutMs: 1e4 })).stdout.trim();
   const pnpm = (await run(tc.pnpm, ["--version"], { env: tc.env, timeoutMs: 2e4 })).stdout.trim();
-  await fs6.mkdir(cfg.home, { recursive: true });
+  await fs7.mkdir(cfg.home, { recursive: true });
   return { installed, node: node2, pnpm, source: tc.source };
 }
 async function installFnmLts(cfg, env) {
-  await fs6.mkdir(cfg.fnmDir, { recursive: true });
+  await fs7.mkdir(cfg.fnmDir, { recursive: true });
   const script = await (await fetch("https://fnm.vercel.app/install")).text();
   const sh = await run("bash", ["-s", "--", "--install-dir", cfg.fnmDir, "--skip-shell"], { env, input: script, timeoutMs: 3e5 });
   if (sh.code !== 0) throw new Error(`fnm installer failed: ${sh.stderr.trim().slice(-300)}`);
-  const fnm = path6.join(cfg.fnmDir, "fnm");
+  const fnm = path7.join(cfg.fnmDir, "fnm");
   const fnmEnv = { ...env, FNM_DIR: cfg.fnmDir };
   const inst = await run(fnm, ["install", "--lts"], { env: fnmEnv, timeoutMs: 6e5 });
   if (inst.code !== 0) throw new Error(`fnm install --lts failed: ${inst.stderr.trim().slice(-300)}`);
   const def = await run(fnm, ["default", "lts-latest"], { env: fnmEnv, timeoutMs: 6e4 });
   if (def.code !== 0) throw new Error(`fnm default failed: ${def.stderr.trim().slice(-300)}`);
-  const bin = path6.join(cfg.fnmDir, "aliases", "default", "bin");
-  const childEnv = { ...env, PATH: `${bin}${path6.delimiter}${env.PATH ?? ""}`, COREPACK_ENABLE_DOWNLOAD_PROMPT: "0", npm_config_verify_deps_before_run: "false" };
-  const enable = await run(path6.join(bin, "corepack"), ["enable", "--install-directory", bin], { env: childEnv, timeoutMs: 6e4 });
+  const bin = path7.join(cfg.fnmDir, "aliases", "default", "bin");
+  const childEnv = { ...env, PATH: `${bin}${path7.delimiter}${env.PATH ?? ""}`, COREPACK_ENABLE_DOWNLOAD_PROMPT: "0", npm_config_verify_deps_before_run: "false" };
+  const enable = await run(path7.join(bin, "corepack"), ["enable", "--install-directory", bin], { env: childEnv, timeoutMs: 6e4 });
   if (enable.code !== 0) throw new Error(`corepack enable failed: ${enable.stderr.trim().slice(-300)}`);
-  const prep = await run(path6.join(bin, "corepack"), ["prepare", `pnpm@${cfg.pnpmVersion}`, "--activate"], { env: childEnv, timeoutMs: 3e5 });
+  const prep = await run(path7.join(bin, "corepack"), ["prepare", `pnpm@${cfg.pnpmVersion}`, "--activate"], { env: childEnv, timeoutMs: 3e5 });
   if (prep.code !== 0) throw new Error(`corepack prepare pnpm failed: ${prep.stderr.trim().slice(-300)}`);
 }
 
 // src/preview.ts
 function registryFile(cfg) {
-  return path7.join(cfg.stateDir, "previews.json");
+  return path8.join(cfg.stateDir, "previews.json");
 }
 async function readRegistry(cfg) {
   try {
-    return JSON.parse(await fs7.readFile(registryFile(cfg), "utf8"));
+    return JSON.parse(await fs8.readFile(registryFile(cfg), "utf8"));
   } catch {
     return {};
   }
 }
 async function writeRegistry(cfg, reg) {
-  await fs7.mkdir(cfg.stateDir, { recursive: true, mode: 448 });
-  await fs7.writeFile(registryFile(cfg), JSON.stringify(reg, null, 2) + "\n");
+  await fs8.mkdir(cfg.stateDir, { recursive: true, mode: 448 });
+  await fs8.writeFile(registryFile(cfg), JSON.stringify(reg, null, 2) + "\n");
 }
 async function freePort(from = 3e3, to = 3099) {
   for (let p = from; p <= to; p++) {
@@ -36695,9 +36833,9 @@ async function startPreview(cfg, tc, app, dir, opts = {}) {
   const existing = await runningPreview(cfg, app, fetchImpl);
   if (existing) return { port: existing.port, url: `http://127.0.0.1:${existing.port}`, reused: true };
   const port = await freePort();
-  await fs7.mkdir(path7.join(dir, ".sindri"), { recursive: true });
-  const logFile = path7.join(dir, ".sindri", "preview.log");
-  await fs7.writeFile(logFile, "");
+  await fs8.mkdir(path8.join(dir, ".sindri"), { recursive: true });
+  const logFile = path8.join(dir, ".sindri", "preview.log");
+  await fs8.writeFile(logFile, "");
   const env = { ...tc.env, KIGO_ENV: "local", DATABASE_URL: "", PORT: String(port), CI: "1", FORCE_COLOR: "0", BROWSER: "none" };
   const pid = spawnDetached(tc.pnpm, [...PNPM_ARGS, "dev", "--port", String(port)], { cwd: dir, env, logFile });
   const reg = await readRegistry(cfg);
@@ -36713,7 +36851,7 @@ async function startPreview(cfg, tc, app, dir, opts = {}) {
   killTree(pid);
   delete reg[app];
   await writeRegistry(cfg, reg);
-  const log = await fs7.readFile(logFile, "utf8").catch(() => "");
+  const log = await fs8.readFile(logFile, "utf8").catch(() => "");
   return { port, url: `http://127.0.0.1:${port}`, reused: false, log: log.split("\n").slice(-15).join("\n") };
 }
 async function stopPreview(cfg, app) {
@@ -36730,11 +36868,200 @@ async function openInBrowser(cfg, url2) {
   await run(cfg.opener, [url2], { timeoutMs: 1e4 });
 }
 
+// src/schedules.ts
+var SCHEDULE_NAME_RE = /^[a-z][a-z0-9-]{1,31}$/;
+var SCHEDULE_EVERY = ["5m", "10m", "15m", "30m", "1h", "2h", "6h", "12h", "1d"];
+var SCHEDULES_MAX = 5;
+function readSchedules(manifestText) {
+  const raw = manifestValue(manifestText, "schedules");
+  if (raw === void 0 || raw.trim() === "") return { ok: true, tasks: [] };
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { ok: false, error: "La l\xEDnea schedules de kigo-app.yaml no es una lista JSON v\xE1lida." };
+  }
+  if (!Array.isArray(parsed)) return { ok: false, error: "La l\xEDnea schedules de kigo-app.yaml debe ser una lista JSON." };
+  if (parsed.length > SCHEDULES_MAX) return { ok: false, error: `Una app puede declarar hasta ${SCHEDULES_MAX} tareas.` };
+  const tasks = [];
+  for (const item of parsed) {
+    if (!item || typeof item !== "object") return { ok: false, error: "Cada tarea de schedules debe ser un objeto {name, path, every}." };
+    const { name, path: path11, every } = item;
+    if (typeof name !== "string" || !SCHEDULE_NAME_RE.test(name)) {
+      return { ok: false, error: `El nombre de tarea ${JSON.stringify(name)} no es v\xE1lido: min\xFAsculas, d\xEDgitos y guiones, de 2 a 32 letras.` };
+    }
+    if (tasks.some((t) => t.name === name)) return { ok: false, error: `La tarea \xAB${name}\xBB est\xE1 declarada dos veces.` };
+    if (typeof path11 !== "string" || !path11.startsWith("/api/") || path11.includes("?") || path11.includes("#")) {
+      return { ok: false, error: `La ruta de la tarea \xAB${name}\xBB debe empezar con /api/ y no llevar par\xE1metros.` };
+    }
+    if (typeof every !== "string" || !SCHEDULE_EVERY.includes(every)) {
+      return { ok: false, error: `La frecuencia de la tarea \xAB${name}\xBB debe ser una de: ${SCHEDULE_EVERY.join(", ")}.` };
+    }
+    tasks.push({ name, path: path11, every });
+  }
+  return { ok: true, tasks };
+}
+
+// src/secretpage.ts
+import { randomBytes as randomBytes3 } from "node:crypto";
+import http2 from "node:http";
+var SECRET_MAX_BYTES = 8 * 1024;
+var SecretPageBrowserUnavailable = class extends Error {
+  constructor() {
+    super("browser unavailable");
+  }
+};
+async function collectSecret(opts) {
+  const nonce = randomBytes3(16).toString("base64url");
+  const server = http2.createServer();
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => resolve());
+  });
+  const port = server.address().port;
+  const origin = `http://127.0.0.1:${port}`;
+  const route = `/s/${nonce}`;
+  const url2 = `${origin}${route}`;
+  let timer;
+  let settled = null;
+  let used = false;
+  const done = new Promise((res0, rej0) => {
+    const resolve = () => {
+      settled = { ok: true };
+      res0();
+    };
+    const reject = (e) => {
+      settled = { err: e };
+      rej0(e);
+    };
+    timer = setTimeout(() => reject(new Error("expired")), opts.timeoutMs ?? 5 * 6e4);
+    server.on("request", (req, res) => {
+      const html = (status, body) => {
+        res.writeHead(status, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store", "Referrer-Policy": "no-referrer", "X-Frame-Options": "DENY" });
+        res.end(body);
+      };
+      const u = new URL(req.url ?? "/", origin);
+      if (u.pathname !== route || used) {
+        html(404, PAGE("Esta p\xE1gina ya no est\xE1 disponible.", "Vuelve a Claude y pide guardar el secreto otra vez."));
+        return;
+      }
+      if (req.method === "GET") {
+        html(200, FORM_PAGE(opts.app, opts.name, opts.hint));
+        return;
+      }
+      if (req.method !== "POST") {
+        res.writeHead(405, { Allow: "GET, POST" }).end();
+        return;
+      }
+      const from = req.headers.origin;
+      if (from && from !== origin) {
+        html(403, PAGE("Esa petici\xF3n no viene de esta p\xE1gina.", "Vuelve a Claude y pide guardar el secreto otra vez."));
+        return;
+      }
+      const chunks = [];
+      let size = 0;
+      let tooBig = false;
+      req.on("data", (c) => {
+        size += c.length;
+        if (size > SECRET_MAX_BYTES * 3 + 1024) {
+          tooBig = true;
+          req.destroy();
+          return;
+        }
+        chunks.push(c);
+      });
+      req.on("end", () => {
+        if (tooBig) return;
+        const body = new URLSearchParams(Buffer.concat(chunks).toString("utf8"));
+        let value = body.get("value") ?? "";
+        value = value.replace(/\r?\n$/, "");
+        if (value === "") {
+          html(400, FORM_PAGE(opts.app, opts.name, opts.hint, "Pega el valor antes de guardar."));
+          return;
+        }
+        if (Buffer.byteLength(value, "utf8") > SECRET_MAX_BYTES) {
+          html(400, FORM_PAGE(opts.app, opts.name, opts.hint, "El valor es demasiado largo (m\xE1ximo 8 KB)."));
+          return;
+        }
+        used = true;
+        opts.onValue(value).then(() => {
+          html(200, PAGE("Listo, ya puedes volver a Claude.", `El secreto ${escapeHtml(opts.name)} qued\xF3 guardado para \xAB${escapeHtml(opts.app)}\xBB. Puedes cerrar esta pesta\xF1a.`));
+          clearTimeout(timer);
+          resolve();
+        }).catch((err) => {
+          html(500, PAGE("No se pudo guardar el secreto.", "Vuelve a Claude: ah\xED te digo qu\xE9 pas\xF3 y lo intentamos de nuevo."));
+          clearTimeout(timer);
+          reject(err instanceof Error ? err : new Error(String(err)));
+        });
+      });
+    });
+  });
+  done.catch(() => void 0);
+  try {
+    if (!await opts.openUrl(url2)) {
+      const state0 = settled;
+      if (state0?.err) throw state0.err;
+      if (!state0) throw new SecretPageBrowserUnavailable();
+    }
+    await done;
+    return { url: url2 };
+  } finally {
+    clearTimeout(timer);
+    server.close();
+    server.closeAllConnections?.();
+  }
+}
+function escapeHtml(s) {
+  return s.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
+}
+var STYLE = `
+:root{--primary:#FF6900;--bg:#FEF9F8;--card:#fff;--fg:#0f172a;--muted:#64748b;--border:#e7e0dc;--danger:#b91c1c}
+*{box-sizing:border-box}
+body{margin:0;min-height:100vh;display:grid;place-items:center;background:var(--bg);color:var(--fg);font:15px/1.5 system-ui,-apple-system,"Segoe UI",Roboto,sans-serif}
+main{width:min(30rem,calc(100vw - 2rem));background:var(--card);border:1px solid var(--border);border-radius:20px;padding:2rem}
+.brand{display:flex;align-items:center;gap:.5rem;color:var(--muted);font-size:12px;letter-spacing:.06em;text-transform:uppercase;font-weight:600;margin-bottom:1.25rem}
+.brand i{display:inline-block;width:10px;height:10px;border-radius:50%;background:var(--primary)}
+h1{font-size:20px;margin:0 0 .5rem;font-weight:600}
+p{margin:0 0 1rem;color:var(--muted)}
+code{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;background:#f5efec;padding:.1rem .4rem;border-radius:6px;color:var(--fg)}
+label{display:block;font-size:13px;font-weight:600;margin:1rem 0 .35rem}
+.field{display:flex;gap:.5rem}
+input{flex:1;min-width:0;height:44px;padding:0 .75rem;font:inherit;font-family:ui-monospace,SFMono-Regular,Menlo,monospace;border:1px solid var(--border);border-radius:12px;background:#fff;color:var(--fg)}
+input:focus-visible,button:focus-visible{outline:2px solid var(--primary);outline-offset:2px}
+button{height:44px;padding:0 1rem;font:inherit;font-weight:600;border-radius:12px;border:1px solid var(--border);background:#fff;color:var(--fg);cursor:pointer}
+button.primary{background:var(--primary);border-color:var(--primary);color:#fff;width:100%;margin-top:1.25rem}
+.error{color:var(--danger);font-size:13px;margin:.5rem 0 0}
+.note{font-size:13px;margin-top:1rem}
+`;
+function shell(title, body) {
+  return `<!doctype html><html lang="es"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="referrer" content="no-referrer"><title>${escapeHtml(title)}</title><style>${STYLE}</style></head><body><main><div class="brand"><i></i>Kigo Sindri</div>${body}</main></body></html>`;
+}
+function FORM_PAGE(app, name, hint, error61) {
+  const title = `Guardar secreto para \xAB${app}\xBB`;
+  return shell(
+    title,
+    `<h1>${escapeHtml(title)}</h1>
+<p>Clave: <code>${escapeHtml(name)}</code></p>
+${hint ? `<p>${escapeHtml(hint)}</p>` : ""}
+<form method="post" autocomplete="off">
+<label for="value">Valor</label>
+<div class="field"><input id="value" name="value" type="password" autofocus autocomplete="off" autocapitalize="off" spellcheck="false" required maxlength="8192"><button type="button" id="toggle" aria-pressed="false">mostrar</button></div>
+${error61 ? `<p class="error" role="alert">${escapeHtml(error61)}</p>` : ""}
+<button type="submit" class="primary">Guardar</button>
+</form>
+<p class="note">Se guarda en tu computadora y en Sindri. Claude no lo ve ni lo repite.</p>
+<script>(function(){var i=document.getElementById("value"),b=document.getElementById("toggle");b.addEventListener("click",function(){var show=i.type==="password";i.type=show?"text":"password";b.textContent=show?"ocultar":"mostrar";b.setAttribute("aria-pressed",String(show));i.focus();});})();</script>`
+  );
+}
+function PAGE(title, text) {
+  return shell(title, `<h1>${escapeHtml(title)}</h1><p>${text}</p>`);
+}
+
 // src/tree.ts
 import { createHash as createHash2 } from "node:crypto";
-import fs8 from "node:fs/promises";
+import fs9 from "node:fs/promises";
 import os3 from "node:os";
-import path8 from "node:path";
+import path9 from "node:path";
 var EXCLUDED_DIRS = /* @__PURE__ */ new Set(["node_modules", ".next", ".sindri", "dist", ".turbo", ".git"]);
 function excluded(name) {
   if (EXCLUDED_DIRS.has(name)) return true;
@@ -36745,11 +37072,11 @@ function excluded(name) {
 async function listFiles(root) {
   const out = [];
   async function walk(dir, rel) {
-    const entries = await fs8.readdir(dir, { withFileTypes: true });
+    const entries = await fs9.readdir(dir, { withFileTypes: true });
     for (const e of entries) {
       if (excluded(e.name)) continue;
       const r = rel ? `${rel}/${e.name}` : e.name;
-      if (e.isDirectory()) await walk(path8.join(dir, e.name), r);
+      if (e.isDirectory()) await walk(path9.join(dir, e.name), r);
       else if (e.isFile()) out.push(r);
     }
   }
@@ -36760,7 +37087,7 @@ async function treeHash(root) {
   const files = await listFiles(root);
   const h = createHash2("sha256");
   for (const rel of files) {
-    const fh = createHash2("sha256").update(await fs8.readFile(path8.join(root, rel))).digest("hex");
+    const fh = createHash2("sha256").update(await fs9.readFile(path9.join(root, rel))).digest("hex");
     h.update(`${rel}\0${fh}
 `);
   }
@@ -36769,49 +37096,49 @@ async function treeHash(root) {
 async function packTree(root) {
   const files = await listFiles(root);
   if (files.length === 0) throw new Error("empty tree");
-  const listFile = path8.join(await fs8.mkdtemp(path8.join(os3.tmpdir(), "sindri-pack-")), "files.txt");
-  await fs8.writeFile(listFile, files.join("\n") + "\n");
-  const out = path8.join(path8.dirname(listFile), "app.tar.gz");
+  const listFile = path9.join(await fs9.mkdtemp(path9.join(os3.tmpdir(), "sindri-pack-")), "files.txt");
+  await fs9.writeFile(listFile, files.join("\n") + "\n");
+  const out = path9.join(path9.dirname(listFile), "app.tar.gz");
   const r = await run("tar", ["-czf", out, "-C", root, "-T", listFile], { timeoutMs: 12e4 });
   if (r.code !== 0) throw new Error(`tar failed: ${r.stderr.trim()}`);
-  const st = await fs8.stat(out);
+  const st = await fs9.stat(out);
   return { file: out, files: files.length, bytes: st.size };
 }
 async function replaceTree(root, archive) {
-  const tmp = await fs8.mkdtemp(path8.join(os3.tmpdir(), "sindri-unpack-"));
+  const tmp = await fs9.mkdtemp(path9.join(os3.tmpdir(), "sindri-unpack-"));
   const r = await run("tar", ["-xzf", archive, "-C", tmp], { timeoutMs: 12e4 });
   if (r.code !== 0) throw new Error(`tar failed: ${r.stderr.trim()}`);
   const src = await singleRoot(tmp);
-  await fs8.mkdir(root, { recursive: true });
+  await fs9.mkdir(root, { recursive: true });
   await prune(root, 0);
-  await fs8.cp(src, root, { recursive: true, force: true, filter: (s) => path8.basename(s) !== "node_modules" && path8.basename(s) !== ".DS_Store" });
-  await fs8.rm(tmp, { recursive: true, force: true });
+  await fs9.cp(src, root, { recursive: true, force: true, filter: (s) => path9.basename(s) !== "node_modules" && path9.basename(s) !== ".DS_Store" });
+  await fs9.rm(tmp, { recursive: true, force: true });
 }
 async function prune(dir, depth) {
-  const entries = await fs8.readdir(dir, { withFileTypes: true });
+  const entries = await fs9.readdir(dir, { withFileTypes: true });
   for (const e of entries) {
-    const p = path8.join(dir, e.name);
+    const p = path9.join(dir, e.name);
     if (e.name === "node_modules") continue;
     if (depth === 3 && (e.name === ".sindri" || /^\.env(\..*)?$/.test(e.name))) continue;
     if (e.isDirectory()) {
       await prune(p, depth + 1);
-      const left = await fs8.readdir(p);
-      if (left.length === 0) await fs8.rmdir(p);
+      const left = await fs9.readdir(p);
+      if (left.length === 0) await fs9.rmdir(p);
     } else {
-      await fs8.rm(p, { force: true });
+      await fs9.rm(p, { force: true });
     }
   }
 }
 async function singleRoot(dir) {
-  const entries = (await fs8.readdir(dir, { withFileTypes: true })).filter((e) => e.name !== ".DS_Store");
-  if (entries.length === 1 && entries[0]?.isDirectory() && !await exists2(path8.join(dir, "package.json"))) {
-    return path8.join(dir, entries[0].name);
+  const entries = (await fs9.readdir(dir, { withFileTypes: true })).filter((e) => e.name !== ".DS_Store");
+  if (entries.length === 1 && entries[0]?.isDirectory() && !await exists2(path9.join(dir, "package.json"))) {
+    return path9.join(dir, entries[0].name);
   }
   return dir;
 }
 async function exists2(p) {
   try {
-    await fs8.access(p);
+    await fs9.access(p);
     return true;
   } catch {
     return false;
@@ -36819,14 +37146,14 @@ async function exists2(p) {
 }
 async function readPublished(root) {
   try {
-    return JSON.parse(await fs8.readFile(path8.join(root, ".sindri", "last-published.json"), "utf8"));
+    return JSON.parse(await fs9.readFile(path9.join(root, ".sindri", "last-published.json"), "utf8"));
   } catch {
     return null;
   }
 }
 async function writePublished(root, p) {
-  await fs8.mkdir(path8.join(root, ".sindri"), { recursive: true });
-  await fs8.writeFile(path8.join(root, ".sindri", "last-published.json"), JSON.stringify(p, null, 2) + "\n");
+  await fs9.mkdir(path9.join(root, ".sindri"), { recursive: true });
+  await fs9.writeFile(path9.join(root, ".sindri", "last-published.json"), JSON.stringify(p, null, 2) + "\n");
 }
 
 // src/tools.ts
@@ -36859,7 +37186,7 @@ var SCHEMAS = {
   preview: { app: appName },
   publish: {
     app: appName,
-    message: external_exports.string().min(3).max(MESSAGE_MAX).describe("What changed, in Spanish, as the PM would say it (becomes the version label).")
+    message: external_exports.string().min(3).max(MESSAGE_MAX).describe("What changed, in Spanish, as the builder would say it (becomes the version label).")
   },
   status: { app: appName },
   list_apps: {},
@@ -36869,27 +37196,42 @@ var SCHEMAS = {
   rename_app: {
     app: appName,
     new_name: appName.optional().describe("New address: lowercase letters, digits and hyphens (2 to 31 chars). Becomes https://<new_name>.sindri.kigo.dev; the old address stops working."),
-    display_name: external_exports.string().min(2).max(60).optional().describe("New visible name (the title people see), in Spanish, as the PM wrote it. The address does not change.")
+    display_name: external_exports.string().min(2).max(60).optional().describe("New visible name (the title people see), in Spanish, as the builder wrote it. The address does not change.")
   },
   delete_app: {
     app: appName,
-    confirm: external_exports.string().describe("The app name exactly as the PM typed it to confirm. Must equal `app`; never fill it in for them.")
+    confirm: external_exports.string().describe("The app name exactly as the builder typed it to confirm. Must equal `app`; never fill it in for them.")
   },
   share: { app: appName },
   help: {},
   design_guide: {
     app: appName,
     topic: external_exports.string().min(1).max(60).optional().describe("A reference topic from `topics` (admin, landing, mini-app, mobile, tokens, writing, checklist). Omit for the overview (SKILL.md) and the list of topics.")
+  },
+  set_secret: {
+    app: appName,
+    name: external_exports.string().min(2).max(64).describe("Environment variable name the code reads as process.env.NAME: uppercase letters, digits and underscores (e.g. LINEAR_API_KEY). Platform keys are refused."),
+    hint: external_exports.string().min(3).max(200).optional().describe("One line in Spanish shown on the page telling the builder what to paste (e.g. \xABla clave de API de Linear, solo lectura\xBB).")
+  },
+  list_secrets: { app: appName },
+  delete_secret: {
+    app: appName,
+    name: external_exports.string().min(2).max(64).describe("The secret's name, as listed by list_secrets.")
+  },
+  run_task: {
+    app: appName,
+    task: external_exports.string().min(2).max(32).describe("Task name as declared in the `schedules` line of kigo-app.yaml."),
+    where: external_exports.enum(["local", "sindri"]).optional().describe("Where to run it: `local` calls the route of the running preview on this computer; `sindri` runs it in the published app. Default: local when a preview is running, else sindri.")
   }
 };
 var DESCRIPTIONS = {
   setup: {
     title: "Set up this computer",
-    description: "Installs what Sindri needs on the PM's computer (Node.js and pnpm, in the user's home, no admin rights) and creates the Sindri folder. Run it once per machine, before the first create_app, or whenever another tool answers needs_setup. Safe to repeat."
+    description: "Installs what Sindri needs on the builder's computer (Node.js and pnpm, in the user's home, no admin rights) and creates the Sindri folder. Run it once per machine, before the first create_app, or whenever another tool answers needs_setup. Safe to repeat."
   },
   login: {
     title: "Sign in to Kigo",
-    description: "Signs the PM in with their Kigo account (opens the browser; they enter with their @cargomovil.com Google account). Run it when another tool answers needs_login. Credentials are stored on this computer."
+    description: "Signs the builder in with their Kigo account (opens the browser; they enter with their @cargomovil.com Google account). Run it when another tool answers needs_login. Credentials are stored on this computer."
   },
   create_app: {
     title: "Create an app",
@@ -36897,7 +37239,7 @@ var DESCRIPTIONS = {
   },
   preview: {
     title: "Preview locally",
-    description: "Runs the app on this computer with test data and opens it in the browser (http://127.0.0.1:<port>). Reuses a running preview. Use it to show the PM changes before publishing; edits reload automatically."
+    description: "Runs the app on this computer with test data and opens it in the browser (http://127.0.0.1:<port>). Reuses a running preview. Use it to show the builder changes before publishing; edits reload automatically."
   },
   publish: {
     title: "Publish to Sindri",
@@ -36907,7 +37249,7 @@ var DESCRIPTIONS = {
     title: "App status",
     description: "Address, last published version, whether the local folder exists and whether it has unpublished changes."
   },
-  list_apps: { title: "List apps", description: "The PM's apps in Sindri, with address, last version and whether each has a local folder." },
+  list_apps: { title: "List apps", description: "The builder's apps in Sindri, with address, last version and whether each has a local folder." },
   versions: { title: "Versions", description: "Published versions of an app, most recent first (id, date, label)." },
   rollback: {
     title: "Go back to a version",
@@ -36915,24 +37257,40 @@ var DESCRIPTIONS = {
   },
   update_template: {
     title: "Update the template",
-    description: "Brings the app up to the current Kigo template: files the app never customised are replaced, files you changed are left alone and listed. Publishes a version \xABPlantilla actualizada\xBB and brings the local folder to it. Use it when the PM asks to update the template or Sindri announces a template fix. Refuses while there are unpublished local edits: publish (or discard) them first."
+    description: "Brings the app up to the current Kigo template: files the app never customised are replaced, files you changed are left alone and listed. Publishes a version \xABPlantilla actualizada\xBB and brings the local folder to it. Use it when the builder asks to update the template or Sindri announces a template fix. Refuses while there are unpublished local edits: publish (or discard) them first."
   },
   rename_app: {
     title: "Rename an app",
-    description: 'Two different things, pass at least one. `new_name` changes the address (https://<new_name>.sindri.kigo.dev): Sindri renames it, the local folder is moved to match and the old address stops working; refuses while the folder has unpublished edits (publish first). `display_name` changes only the visible name: it is written to kigo-app.yaml and published as \xABAhora se llama \xAB<display_name>\xBB\xBB. When the PM says "c\xE1mbiale el nombre" and it is unclear which one they mean, ask: \xBFla direcci\xF3n o el nombre que se ve? Both together are allowed (visible name first, then the address).'
+    description: 'Two different things, pass at least one. `new_name` changes the address (https://<new_name>.sindri.kigo.dev): Sindri renames it, the local folder is moved to match and the old address stops working; refuses while the folder has unpublished edits (publish first). `display_name` changes only the visible name: it is written to kigo-app.yaml and published as \xABAhora se llama \xAB<display_name>\xBB\xBB. When the builder says "c\xE1mbiale el nombre" and it is unclear which one they mean, ask: \xBFla direcci\xF3n o el nombre que se ve? Both together are allowed (visible name first, then the address).'
   },
   delete_app: {
     title: "Delete an app",
-    description: "Removes the app from Sindri (address, published versions and its database) after the PM typed its name: `confirm` must equal `app`, ask them to write it, never guess it. Stops the preview and moves the local folder to ~/Sindri/.papelera/<app>-<date> instead of deleting it, so the PM can still recover the files by hand."
+    description: "Removes the app from Sindri (address, published versions and its database) after the builder typed its name: `confirm` must equal `app`, ask them to write it, never guess it. Stops the preview and moves the local folder to ~/Sindri/.papelera/<app>-<date> instead of deleting it, so the builder can still recover the files by hand."
   },
   share: { title: "Share", description: "The line to paste in Slack: address, test-data notice and how the team enters." },
   help: {
     title: "What Sindri is",
-    description: "No network. The Spanish introduction to give the PM the first time they speak in a conversation or whenever they ask what Sindri can do: what it is, what they can ask for, the limits and the link to Mi espacio. Also says whether they are already signed in on this computer (`logged_in`) and where their apps live (`apps_dir`)."
+    description: "No network. The Spanish introduction to give the builder the first time they speak in a conversation or whenever they ask what Sindri can do: what it is, what they can ask for, the limits and the link to Mi espacio. Also says whether they are already signed in on this computer (`logged_in`) and where their apps live (`apps_dir`)."
   },
   design_guide: {
     title: "Design guide",
-    description: "No network. Kigo's design guide for Sindri apps, read from the app folder (the kigo-sindri-design skill the template ships). Call it before creating or changing any page, component, layout, style or copy: first without `topic` (the overview plus the list of `topics`), then with the topic that matches what you are building (admin, landing, mini-app, mobile). `content` is markdown for you to follow, not to paste to the PM. If it answers `no_design_guide`, the app predates the guide: run update_template once and retry."
+    description: "No network. Kigo's design guide for Sindri apps, read from the app folder (the kigo-sindri-design skill the template ships). Call it before creating or changing any page, component, layout, style or copy: first without `topic` (the overview plus the list of `topics`), then with the topic that matches what you are building (admin, landing, mini-app, mobile). `content` is markdown for you to follow, not to paste to the builder. If it answers `no_design_guide`, the app predates the guide: run update_template once and retry."
+  },
+  set_secret: {
+    title: "Save a secret",
+    description: "Asks the builder for a credential (API key, token, password) without it ever passing through the conversation: opens a page in their browser where they paste the value, stores it in the app's .env.local on this computer and in Sindri, and restarts the running preview so the code sees it. Call it whenever the app needs a credential; never ask the builder to paste it in chat and never write it in code. Refer to it in code as process.env.NAME. Waits up to five minutes. The result never contains the value."
+  },
+  list_secrets: {
+    title: "List secrets",
+    description: "Names (never values) of the app's secrets in Sindri (`names`) and in the .env.local on this computer (`local_names`), so you can tell when one side is missing. Platform keys are not listed."
+  },
+  delete_secret: {
+    title: "Delete a secret",
+    description: "Removes a secret from the app's .env.local on this computer and from Sindri, and restarts the running preview. Ask the builder before calling it."
+  },
+  run_task: {
+    title: "Run a scheduled task now",
+    description: 'Runs one of the app\'s scheduled tasks (declared in the `schedules` line of kigo-app.yaml) and reports status, HTTP status, duration and the tail of its output. `where: "local"` calls the route of the preview running on this computer with the local task token; `where: "sindri"` runs it in the published app. Default: local when a preview is running, else sindri. Test a task locally before publishing it.'
   }
 };
 function createTools(deps) {
@@ -37027,14 +37385,14 @@ function createTools(deps) {
     }
     const created = await api.createApp(a.name, a.description.trim());
     const archive = await api.download(created.archive_url);
-    await fs9.mkdir(p.root, { recursive: true });
+    await fs10.mkdir(p.root, { recursive: true });
     await replaceTree(p.root, archive);
-    await fs9.rm(path9.dirname(archive), { recursive: true, force: true });
+    await fs10.rm(path10.dirname(archive), { recursive: true, force: true });
     p = await appPaths(cfg, a.name, me.owner);
     if (!await appPresent(p)) {
       return { ok: false, summary: `Cre\xE9 "${a.name}" en Sindri pero lo que baj\xF3 no trae la app donde la espero (apps/${p.owner || me.owner}/${a.name}). Escribe en Slack, canal #sindri.`, path: p.root, url: created.url };
     }
-    await fs9.writeFile(path9.join(p.appDir, ".env.local"), "KIGO_ENV=local\n", { mode: 384 });
+    await ensureLocalEnv(p.appDir, a.name);
     const install = await run(tc.pnpm, [...PNPM_ARGS, "install", "--no-frozen-lockfile"], { cwd: p.root, env: { ...tc.env, CI: "1", FORCE_COLOR: "0" }, timeoutMs: 6e5 });
     if (install.code !== 0) {
       const why = lastLine(install.stderr || install.stdout);
@@ -37064,7 +37422,7 @@ function createTools(deps) {
     }
     const tc = await toolchain();
     if (!tc) return NEEDS_SETUP;
-    if (!await exists2(path9.join(p.root, "node_modules"))) {
+    if (!await exists2(path10.join(p.root, "node_modules"))) {
       const install = await run(tc.pnpm, [...PNPM_ARGS, "install", "--no-frozen-lockfile"], { cwd: p.root, env: { ...tc.env, CI: "1", FORCE_COLOR: "0" }, timeoutMs: 6e5 });
       if (install.code !== 0) return { ok: false, summary: `No pude preparar la app para correrla en tu computadora (${lastLine(install.stderr || install.stdout)}). Vuelve a intentarlo.`, detail: lastLine(install.stderr || install.stdout) };
     }
@@ -37105,14 +37463,14 @@ function createTools(deps) {
     }
     const packed = await packTree(dir);
     if (packed.bytes > 20 * 1024 * 1024) {
-      await fs9.rm(path9.dirname(packed.file), { recursive: true, force: true });
+      await fs10.rm(path10.dirname(packed.file), { recursive: true, force: true });
       return { ok: false, summary: "La app pesa m\xE1s de 20 MB sin contar sus piezas instaladas. Quita archivos grandes (im\xE1genes, videos) antes de publicar.", bytes: packed.bytes };
     }
     let result;
     try {
       result = await api.publish(a.app, packed.file, message);
     } finally {
-      await fs9.rm(path9.dirname(packed.file), { recursive: true, force: true });
+      await fs10.rm(path10.dirname(packed.file), { recursive: true, force: true });
     }
     await writePublished(dir, { version: result.version, tree_hash: await treeHash(dir), url: result.url });
     return {
@@ -37131,6 +37489,8 @@ function createTools(deps) {
     if (!local.exists) parts.push("En esta computadora no est\xE1 su carpeta.");
     else if (local.unpublished) parts.push("Tienes cambios en tu computadora que a\xFAn no publicas.");
     else parts.push("Tu carpeta est\xE1 al d\xEDa con lo publicado.");
+    const tasks = describeTasks(info);
+    if (tasks) parts.push(tasks);
     return { ok: true, summary: parts.join(" "), app: info, local };
   });
   const list_apps = guard(async () => {
@@ -37154,16 +37514,16 @@ function createTools(deps) {
     let p = await appPaths(cfg, a.app);
     await stopPreview(cfg, a.app);
     const archive = await api.download(`/v1/apps/${encodeURIComponent(a.app)}/archive`, result.version.id);
-    await fs9.mkdir(p.root, { recursive: true });
+    await fs10.mkdir(p.root, { recursive: true });
     await replaceTree(p.root, archive);
-    await fs9.rm(path9.dirname(archive), { recursive: true, force: true });
+    await fs10.rm(path10.dirname(archive), { recursive: true, force: true });
     p = await appPaths(cfg, a.app, p.owner || void 0);
     const dir = p.appDir;
     if (!await appPresent(p)) return { ok: false, summary: `Sindri volvi\xF3 a la versi\xF3n pero lo que baj\xF3 no trae la app donde la espero. Escribe en Slack, canal #sindri.`, version: result.version, url: result.url };
-    if (!await exists2(path9.join(dir, ".env.local"))) await fs9.writeFile(path9.join(dir, ".env.local"), "KIGO_ENV=local\n", { mode: 384 });
+    await ensureLocalEnv(dir, a.app);
     await linkDesignGuide(p);
     const tc = await toolchain();
-    if (tc && await exists2(path9.join(p.root, "node_modules"))) {
+    if (tc && await exists2(path10.join(p.root, "node_modules"))) {
       const db = await prepareLocalDb(tc, dir);
       if (!db.ok) process.stderr.write(`sindri: local db after rollback: ${db.detail}
 `);
@@ -37193,14 +37553,14 @@ function createTools(deps) {
       await stopPreview(cfg, a.app);
       const archive = await api.download(`/v1/apps/${encodeURIComponent(a.app)}/archive`, result.version?.id);
       await replaceTree(p.root, archive);
-      await fs9.rm(path9.dirname(archive), { recursive: true, force: true });
+      await fs10.rm(path10.dirname(archive), { recursive: true, force: true });
       p = await appPaths(cfg, a.app, p.owner || void 0);
       const dir = p.appDir;
       if (!await appPresent(p)) return { ok: false, summary: `Sindri actualiz\xF3 la plantilla pero lo que baj\xF3 no trae la app donde la espero. Escribe en Slack, canal #sindri.`, ...data };
-      if (!await exists2(path9.join(dir, ".env.local"))) await fs9.writeFile(path9.join(dir, ".env.local"), "KIGO_ENV=local\n", { mode: 384 });
+      await ensureLocalEnv(dir, a.app);
       await linkDesignGuide(p);
       const tc = await toolchain();
-      if (tc && await exists2(path9.join(p.root, "node_modules"))) {
+      if (tc && await exists2(path10.join(p.root, "node_modules"))) {
         const db = await prepareLocalDb(tc, dir);
         if (!db.ok) process.stderr.write(`sindri: local db after update_template: ${db.detail}
 `);
@@ -37252,9 +37612,10 @@ function createTools(deps) {
         await stopPreview(cfg, a.app);
         const newRoot = appRoot(cfg, newName);
         await moveDir(p.root, newRoot);
-        const newDir = path9.join(newRoot, "apps", p.owner, newName);
-        await moveDir(path9.join(newRoot, "apps", p.owner, a.app), newDir);
+        const newDir = path10.join(newRoot, "apps", p.owner, newName);
+        await moveDir(path10.join(newRoot, "apps", p.owner, a.app), newDir);
         await writeManifestValue(newDir, "name", newName);
+        await writeEnvFile(newDir, upsertEnv(await readEnvFile(newDir), "KIGO_APP_NAME", newName));
         await writePublished(newDir, { version: result.version ?? before.published_version, tree_hash: await treeHash(newDir), url: result.url });
         await linkDesignGuide({ root: newRoot, appDir: newDir, owner: p.owner });
         data.path = newDir;
@@ -37281,7 +37642,7 @@ function createTools(deps) {
     }
     let trash = null;
     if (present) {
-      trash = path9.join(cfg.home, ".papelera", `${a.app}-${stamp()}`);
+      trash = path10.join(cfg.home, ".papelera", `${a.app}-${stamp()}`);
       await moveDir(root, trash);
     }
     const kept = "Una copia de sus archivos queda en tu computadora, en la papelera de Sindri; puedes borrarla a mano cuando quieras.";
@@ -37324,21 +37685,147 @@ function createTools(deps) {
       content: guide.content
     };
   });
+  async function restartPreview(app, dir) {
+    if (!await runningPreview(cfg, app, fetchImpl)) return false;
+    const tc = await toolchain();
+    if (!tc) return false;
+    await stopPreview(cfg, app);
+    const r = await startPreview(cfg, tc, app, dir, { fetchImpl, ...deps.sleepImpl ? { sleepImpl: deps.sleepImpl } : {} });
+    return r.log === void 0;
+  }
+  function checkSecretName(name) {
+    if (!validSecretName(name)) {
+      return { ok: false, summary: `"${name}" no sirve como nombre de secreto: va en MAY\xDASCULAS, con n\xFAmeros o guiones bajos, de 2 a 64 letras (por ejemplo LINEAR_API_KEY).`, code: "bad_name" };
+    }
+    if (reservedKey(name)) return { ok: false, summary: `${name} es una clave de la plataforma; no se puede guardar como secreto. Elige otro nombre.`, code: "reserved_key" };
+    return null;
+  }
+  const set_secret = guard(async (a) => {
+    if (!validAppName(a.app)) return { ok: false, summary: "Ese nombre de app no es v\xE1lido." };
+    const name = a.name.trim();
+    const bad = checkSecretName(name);
+    if (bad) return bad;
+    await api.app(a.app);
+    const p = await appPaths(cfg, a.app);
+    const local = await appPresent(p);
+    const openUrl = deps.openUrl ?? defaultOpenUrl(cfg);
+    let restarted = false;
+    try {
+      await collectSecret({
+        app: a.app,
+        name,
+        ...a.hint ? { hint: a.hint.trim() } : {},
+        openUrl,
+        ...deps.secretTimeoutMs ? { timeoutMs: deps.secretTimeoutMs } : {},
+        onValue: async (value) => {
+          if (local) await writeEnvFile(p.appDir, upsertEnv(await readEnvFile(p.appDir), name, value));
+          restarted = (await api.putSecret(a.app, name, value)).restarted;
+        }
+      });
+    } catch (err) {
+      if (err instanceof SecretPageBrowserUnavailable) return { ok: false, summary: "No pude abrir tu navegador para pedirte el secreto. \xC1brelo t\xFA y vuelve a intentarlo.", code: "no_browser" };
+      if (err instanceof Error && err.message === "expired") {
+        return { ok: false, summary: `Pasaron cinco minutos sin que se guardara ${name}. Cuando lo tengas a mano, p\xEDdeme guardarlo de nuevo.`, code: "expired", name };
+      }
+      throw err;
+    }
+    const previewRestarted = local ? await restartPreview(a.app, p.appDir) : false;
+    const where = local ? "en tu computadora y en Sindri" : "en Sindri (en esta computadora no est\xE1 la carpeta de la app)";
+    const applied = previewRestarted ? " Reinici\xE9 la vista previa para que lo tome." : "";
+    return { ok: true, summary: `Listo, ${name} qued\xF3 guardado ${where}.${applied}`, name, restarted, preview_restarted: previewRestarted, local };
+  });
+  const list_secrets = guard(async (a) => {
+    if (!validAppName(a.app)) return { ok: false, summary: "Ese nombre de app no es v\xE1lido." };
+    const names = (await api.listSecrets(a.app)).sort();
+    const p = await appPaths(cfg, a.app);
+    const localNames = await appPresent(p) ? secretKeys(await readEnvFile(p.appDir)).sort() : [];
+    const missingLocal = names.filter((n) => !localNames.includes(n));
+    const missingInSindri = localNames.filter((n) => !names.includes(n));
+    const parts = [names.length === 0 ? `"${a.app}" no tiene secretos en Sindri.` : `"${a.app}" tiene ${names.length === 1 ? "un secreto" : `${names.length} secretos`} en Sindri: ${names.join(", ")}.`];
+    if (missingLocal.length) parts.push(`En tu computadora ${missingLocal.length === 1 ? "falta" : "faltan"} ${missingLocal.join(", ")}.`);
+    if (missingInSindri.length) parts.push(`En Sindri ${missingInSindri.length === 1 ? "falta" : "faltan"} ${missingInSindri.join(", ")} (solo est\xE1 en tu computadora).`);
+    return { ok: true, summary: parts.join(" "), names, local_names: localNames, missing_local: missingLocal, missing_in_sindri: missingInSindri };
+  });
+  const delete_secret = guard(async (a) => {
+    if (!validAppName(a.app)) return { ok: false, summary: "Ese nombre de app no es v\xE1lido." };
+    const name = a.name.trim();
+    const bad = checkSecretName(name);
+    if (bad) return bad;
+    let inSindri = true;
+    try {
+      await api.deleteSecret(a.app, name);
+    } catch (err) {
+      if (err instanceof ApiError && err.status === 404) inSindri = false;
+      else throw err;
+    }
+    const p = await appPaths(cfg, a.app);
+    let hadLocal = false;
+    if (await appPresent(p)) {
+      const text = await readEnvFile(p.appDir);
+      hadLocal = envValue(text, name) !== void 0;
+      if (hadLocal) await writeEnvFile(p.appDir, removeEnv(text, name));
+    }
+    const previewRestarted = hadLocal ? await restartPreview(a.app, p.appDir) : false;
+    const where = inSindri && hadLocal ? "de Sindri y de tu computadora" : inSindri ? "de Sindri" : hadLocal ? "de tu computadora (en Sindri no estaba)" : "";
+    const summary = where ? `Borr\xE9 ${name} ${where}.${previewRestarted ? " Reinici\xE9 la vista previa." : ""}` : `${name} no estaba guardado ni en Sindri ni en tu computadora.`;
+    return { ok: true, summary, name, removed_from_sindri: inSindri, removed_locally: hadLocal, preview_restarted: previewRestarted };
+  });
+  const run_task = guard(async (a) => {
+    if (!validAppName(a.app)) return { ok: false, summary: "Ese nombre de app no es v\xE1lido." };
+    const task = a.task.trim();
+    const p = await appPaths(cfg, a.app);
+    const running = await runningPreview(cfg, a.app, fetchImpl);
+    const where = a.where ?? (running ? "local" : "sindri");
+    if (where === "sindri") {
+      const r2 = await api.runTask(a.app, task);
+      return { ok: r2.ok, summary: describeRun(task, "en Sindri", r2), where, status: r2.status, http_status: r2.http_status, duration_ms: r2.duration_ms, output_tail: r2.output_tail };
+    }
+    if (!await appPresent(p)) return { ok: false, summary: `No encuentro la carpeta de "${a.app}" en tu computadora; corre la tarea en Sindri (where: "sindri").`, code: "no_app" };
+    const schedules = readSchedules(await readManifest(p.appDir));
+    if (!schedules.ok) return { ok: false, summary: schedules.error, code: "bad_schedules" };
+    const declared = schedules.tasks.find((t) => t.name === task);
+    if (!declared) {
+      const names = schedules.tasks.map((t) => t.name);
+      return { ok: false, summary: names.length ? `La tarea \xAB${task}\xBB no est\xE1 declarada en kigo-app.yaml de "${a.app}". Las declaradas son: ${names.join(", ")}.` : `"${a.app}" no declara tareas en kigo-app.yaml todav\xEDa; a\xF1ade la l\xEDnea schedules y vuelve a intentarlo.`, code: "task_not_declared", tasks: names };
+    }
+    const ensured = await ensureLocalEnv(p.appDir, a.app);
+    if (!running) return { ok: false, summary: `La vista previa de "${a.app}" no est\xE1 corriendo. Arr\xE1ncala con preview y vuelve a correr la tarea, o c\xF3rrela en Sindri (where: "sindri").`, code: "no_preview" };
+    if (ensured.created_token) await restartPreview(a.app, p.appDir);
+    const token = envValue(await readEnvFile(p.appDir), "SINDRI_TASK_TOKEN") ?? "";
+    const port = (await runningPreview(cfg, a.app, fetchImpl))?.port ?? running.port;
+    const started = Date.now();
+    let res = null;
+    let timedOut = false;
+    try {
+      res = await fetchImpl(`http://127.0.0.1:${port}${declared.path}`, {
+        method: "POST",
+        headers: { "X-Sindri-Task": task, Authorization: `Bearer ${token}`, Accept: "application/json" },
+        signal: AbortSignal.timeout(LOCAL_TASK_TIMEOUT_MS)
+      });
+    } catch (err) {
+      timedOut = err instanceof Error && err.name === "TimeoutError";
+      if (!timedOut) throw err;
+    }
+    const duration_ms = Date.now() - started;
+    const body = res ? await res.text().catch(() => "") : "";
+    const r = { ok: Boolean(res?.ok), status: timedOut ? "timeout" : res?.ok ? "ok" : "error", http_status: res?.status ?? 0, duration_ms, output_tail: body.slice(-2e3) };
+    return { ok: r.ok, summary: describeRun(task, "en tu computadora", r), where, status: r.status, http_status: r.http_status, duration_ms: r.duration_ms, output_tail: r.output_tail, path: declared.path };
+  });
   const logout = guard(async () => {
     await clearCredentials(cfg);
     return { ok: true, summary: "Saliste de tu cuenta de Kigo en esta computadora." };
   });
-  return { setup, login, create_app, preview, publish, status, list_apps, versions, rollback, update_template, rename_app, delete_app, share, help, design_guide, logout };
+  return { setup, login, create_app, preview, publish, status, list_apps, versions, rollback, update_template, rename_app, delete_app, share, help, design_guide, set_secret, list_secrets, delete_secret, run_task, logout };
 }
 var HELP_SUMMARY = "Sindri te ayuda a crear apps internas peque\xF1as para tu equipo en minutos, con datos de prueba y sin escribir c\xF3digo: t\xFA me cuentas qu\xE9 necesitas y yo la construyo. Puedes pedirme crear una app, verla en tu computadora antes de publicarla, publicarla, cambiarle el nombre o la direcci\xF3n, volver a una versi\xF3n anterior, compartirla en Slack, actualizar su plantilla o borrarla. Ten en cuenta: las apps trabajan con datos sint\xE9ticos, nunca reales; funcionan de lunes a viernes de 9:05 a 24:00, hora de la Ciudad de M\xE9xico; cada app la edita solo quien la cre\xF3; y lo que deba llegar a toda la empresa se pide a desarrollo. Tus apps y sus versiones est\xE1n en https://sindri.kigo.dev.";
 async function moveDir(from, to) {
-  await fs9.mkdir(path9.dirname(to), { recursive: true });
+  await fs10.mkdir(path10.dirname(to), { recursive: true });
   try {
-    await fs9.rename(from, to);
+    await fs10.rename(from, to);
   } catch (err) {
     if (err.code !== "EXDEV") throw err;
-    await fs9.cp(from, to, { recursive: true });
-    await fs9.rm(from, { recursive: true, force: true });
+    await fs10.cp(from, to, { recursive: true });
+    await fs10.rm(from, { recursive: true, force: true });
   }
 }
 function stamp(d = /* @__PURE__ */ new Date()) {
@@ -37357,8 +37844,8 @@ function describeTemplateFiles(r) {
   return parts.length ? ` ${parts.join(" ")}` : "";
 }
 async function prepareLocalDb(tc, dir, opts = {}) {
-  const env = { ...tc.env, KIGO_ENV: "local", DATABASE_URL: "", CI: "1", FORCE_COLOR: "0" };
-  const fresh = !await exists2(path9.join(dir, ".sindri", "pglite"));
+  const env = { ...tc.env, KIGO_ENV: "local", KIGO_APP_NAME: path10.basename(dir), DATABASE_URL: "", CI: "1", FORCE_COLOR: "0" };
+  const fresh = !await exists2(path10.join(dir, ".sindri", "pglite"));
   const migrate = await run(tc.pnpm, [...PNPM_ARGS, "db:migrate"], { cwd: dir, env, timeoutMs: 18e4 });
   if (migrate.code !== 0) return { ok: false, detail: lastLine(migrate.stderr || migrate.stdout) };
   if (opts.seed ?? fresh) {
@@ -37375,6 +37862,23 @@ async function localState(cfg, name) {
   const hash2 = await treeHash(dir);
   return { exists: true, path: dir, unpublished: !published || published.tree_hash !== hash2, published_version: published?.version ?? null };
 }
+var LOCAL_TASK_TIMEOUT_MS = 5 * 6e4;
+function describeTasks(info) {
+  const tasks = info.tasks ?? [];
+  if (tasks.length === 0) return "";
+  const one = (t) => {
+    const last = t.last_run_at ? `\xFAltima ${when(t.last_run_at)}: ${STATUS_WORD[t.last_status ?? "ok"] ?? t.last_status}` : "a\xFAn no corre";
+    return `${t.name} cada ${t.every} (${last})`;
+  };
+  return `${tasks.length === 1 ? "Tarea" : "Tareas"}: ${tasks.map(one).join("; ")}.`;
+}
+var STATUS_WORD = { ok: "bien", error: "fall\xF3", timeout: "se pas\xF3 de tiempo" };
+function describeRun(task, where, r) {
+  const secs = (r.duration_ms / 1e3).toFixed(r.duration_ms < 1e4 ? 1 : 0).replace(".", ",");
+  if (r.status === "ok") return `La tarea \xAB${task}\xBB corri\xF3 ${where} en ${secs} s y termin\xF3 bien.`;
+  if (r.status === "timeout") return `La tarea \xAB${task}\xBB ${where} se pas\xF3 de tiempo (${secs} s) y se cort\xF3. Revisa qu\xE9 la detiene; el detalle est\xE1 en output_tail.`;
+  return `La tarea \xAB${task}\xBB ${where} fall\xF3${r.http_status ? ` (HTTP ${r.http_status})` : ""} tras ${secs} s. Revisa el \xFAltimo cambio; el detalle est\xE1 en output_tail.`;
+}
 function describeVersion(info) {
   if (!info.last_version) return `"${info.name}" a\xFAn no tiene versiones publicadas; su direcci\xF3n ser\xE1 ${info.url}.`;
   return `"${info.name}" est\xE1 en ${info.url}; \xFAltima versi\xF3n ${when(info.last_version.at)}, \xAB${info.last_version.label}\xBB.`;
@@ -37390,7 +37894,7 @@ function when(iso, now = /* @__PURE__ */ new Date()) {
 }
 
 // src/index.ts
-var VERSION = "0.1.4";
+var VERSION = "0.1.5";
 function registerTools(server, tools) {
   for (const name of Object.keys(SCHEMAS)) {
     const meta3 = DESCRIPTIONS[name];