lampson 0.1.0 → 0.1.1

package/lib/permission.syn

@@ -1,154 +1,154 @@
--- lib/permission.syn — política de permisos (allow | deny | ask) sobre las tool calls
---
--- Mezcla de los tres harnesses:
---   * evaluate(tool, args, mode) → allow | deny | ask; "ask" suspende hasta que el humano responde.
---   * 3 niveles — HARDLINE (nunca, ni en yolo), DANGEROUS (pide aprobación; yolo lo pasa; strict lo niega), resto.
---
--- Nota Synsema: el aislamiento de FILESYSTEM ya lo da el lenguaje (file("./*") es el workspace,
--- call_tool intersecta), así que aquí solo miramos el CONTENIDO de los comandos de shell.
---
--- Modos (LAMPSON_PERMISSION): "ask" (default) | "yolo" (dangerous → allow) | "strict" (dangerous → deny)
-
--- Tier 1: nunca. Coincidencia por substring, case-insensitive.
--- (el comando se evalúa con un espacio final añadido, así "rm -rf / " matchea la raíz pero NO "rm -rf /tmp/x")
-export let HARDLINE be [
-    "rm -rf / ", "rm -rf /* ", "rm -fr / ", "rm -rf ~ ", "rm -rf ~/ ", "rm -rf * ", "rm -rf . ", "rm -rf ./ ", "rm -rf .. ",
-    "mkfs", "dd if=", ":(){", "fork bomb",
-    "format c:", "del /s /q c:\\", "rd /s /q c:\\", "rmdir /s /q c:\\",
-    "shutdown", "reboot", "> /dev/sda", "chmod -r 777 /",
-    "git push --force origin main", "git push -f origin main", "git push --force origin master"
-]
-
--- Tier 2: pide aprobación (o deny en strict, allow en yolo).
-export let DANGEROUS be [
-    "rm -rf", "rm -r", "del /s", "rd /s", "rmdir /s", "remove-item -recurse",
-    "git push --force", "git push -f", "git reset --hard", "git clean -f", "git checkout --", "git branch -d",
-    "sudo", "curl | sh", "curl | bash", "wget | sh", "| sh", "| bash",
-    "drop table", "drop database", "truncate table", "delete from",
-    "npm publish", "cargo publish", "pip upload", "twine upload",
-    "docker rm", "docker system prune", "kubectl delete",
-    "chmod", "chown", "> ~/", "crontab",
-    "> .env", ">.env", ">> .env", "tee .env", "> ./.env"
-]
-
-task contains_any(haystack, needles)
-    each n in needles
-        when contains(haystack, lower(n))
-            give n
-    give nothing
-
--- ¿es un archivo de secretos real? ".env", ".env.local", ".env.production"… sí; ".env.example/.sample/.template" no.
-task is_secret_env(base)
-    when base == ".env"
-        give true
-    when not starts_with(base, ".env.")
-        give false
-    each ok in [".env.example", ".env.sample", ".env.template", ".env.dist", ".env.test.example"]
-        when base == ok
-            give false
-    give true
-
--- (`and` no cortocircuita en Synsema: indexar args["action"] sin la clave explota → helper con when anidado)
-task is_install(args)
-    when not contains(args, "action")
-        give false
-    give args["action"] == "install"
-
--- evaluate(tool_name, args, mode) → {decision: "allow"|"deny"|"ask", reason}
-export task evaluate(name, args, mode)
-    when name == "bash"
-        let cmd be (when contains(args, "command") then lower(text(args["command"])) otherwise "") + " "
-        let hard be contains_any(cmd, HARDLINE)
-        when hard != nothing
-            give {"decision": "deny", "reason": "hardline pattern: " + hard}
-        let danger be contains_any(cmd, DANGEROUS)
-        when danger != nothing
-            when mode == "yolo"
-                give {"decision": "allow", "reason": "yolo mode (dangerous: " + danger + ")"}
-            when mode == "strict"
-                give {"decision": "deny", "reason": "strict mode (dangerous: " + danger + ")"}
-            give {"decision": "ask", "reason": "dangerous pattern: " + danger}
-        give {"decision": "allow", "reason": "command"}
-    when name == "write" or name == "edit"
-        -- el scope file("./*") ya impide salir del workspace; aquí solo miramos secretos obvios
-        let p be when contains(args, "path") then lower(replace_text(text(args["path"]), "\\", "/")) otherwise ""
-        let parts be split(p, "/")
-        let base be parts[length(parts) - 1]
-        when is_secret_env(base)
-            when mode == "yolo"
-                give {"decision": "allow", "reason": "yolo mode (.env)"}
-            give {"decision": "ask", "reason": "writes a .env file (secrets)"}
-        give {"decision": "allow", "reason": "workspace write"}
-    when starts_with(name, "mcp_")
-        -- tool de un server MCP (terceros, efectos fuera del workspace): humano por defecto; yolo permite; strict deniega
-        when mode == "yolo"
-            give {"decision": "allow", "reason": "yolo mode (MCP tool)"}
-        when mode == "strict"
-            give {"decision": "deny", "reason": "strict mode (MCP tool)"}
-        give {"decision": "ask", "reason": "MCP tool " + name}
-    when name == "lsp" and contains(args, "op") and text(args["op"]) == "add"
-        -- configurar un language server = el harness va a correr un comando (npx …) del preset: humano siempre
-        when mode == "strict"
-            give {"decision": "deny", "reason": "strict mode (adds an LSP server)"}
-        give {"decision": "ask", "reason": "configures LSP server '" + (when contains(args, "server") then text(args["server"]) otherwise "?") + "' (" + (when contains(args, "scope") then text(args["scope"]) otherwise "global") + ") — it will run the preset command on the first query"}
-    when starts_with(name, "lamp_")
-        -- tool de una lámpara (código del usuario/agente, un proceso por llamada): como las MCP
-        when mode == "yolo"
-            give {"decision": "allow", "reason": "yolo mode (lamp tool)"}
-        when mode == "strict"
-            give {"decision": "deny", "reason": "strict mode (lamp tool)"}
-        give {"decision": "ask", "reason": "lamp tool " + name}
-    when name == "lamp"
-        -- encender una lámpara = autorizar código a correr con las capacidades de su manifiesto: humano SIEMPRE
-        let act be when contains(args, "action") then text(args["action"]) otherwise "list"
-        when act == "enable" or act == "disable"
-            when mode == "strict"
-                give {"decision": "deny", "reason": "strict mode (" + act + " lamp)"}
-            give {"decision": "ask", "reason": act + "s lamp '" + (when contains(args, "name") then text(args["name"]) otherwise "?") + "'"}
-        give {"decision": "allow", "reason": "read-only tool"}
-    when name == "mcp"
-        -- conectar un server MCP = ejecutar un comando de terceros con env propio: humano siempre, incluso en yolo
-        let act be when contains(args, "action") then text(args["action"]) otherwise "list"
-        when act == "add" or act == "remove"
-            when mode == "strict"
-                give {"decision": "deny", "reason": "strict mode (" + act + " MCP server)"}
-            give {"decision": "ask", "reason": act + "s MCP server '" + (when contains(args, "name") then text(args["name"]) otherwise "?") + "'" + (when act == "add" then " → runs: " + (when contains(args, "command") then text(args["command"]) otherwise "?") otherwise "")}
-        give {"decision": "allow", "reason": "read-only tool"}
-    when name == "skill" and is_install(args)
-        -- instala instrucciones/scripts de terceros FUERA del workspace (~/.agents/skills): humano siempre, incluso en yolo
-        when mode == "strict"
-            give {"decision": "deny", "reason": "strict mode (installs a third-party skill)"}
-        give {"decision": "ask", "reason": "installs a third-party skill from " + (when contains(args, "source") then text(args["source"]) otherwise "?") + " (" + (when contains(args, "scope") then text(args["scope"]) otherwise "global") + ")"}
-    give {"decision": "allow", "reason": "read-only tool"}
-
--- Resumen legible de una tool call, para mostrar al humano antes de aprobar / en el log.
-task one_line(s, max)
-    let t be replace_text(replace_text(s, "\r", ""), "\n", " ⏎ ")
-    when length(t) > max
-        give slice(t, 0, max) + "…"
-    give t
-
-export task describe_call(name, args)
-    when starts_with(name, "mcp_") or starts_with(name, "lamp_")
-        give name + " " + one_line(json_encode(args), 160)
-    when name == "lsp" and contains(args, "op") and text(args["op"]) == "add"
-        give "lsp add " + (when contains(args, "server") then text(args["server"]) otherwise "?") + " (" + (when contains(args, "scope") then text(args["scope"]) otherwise "global") + ")"
-    when name == "lsp"
-        give "lsp " + (when contains(args, "op") then text(args["op"]) otherwise "?") + " " + (when contains(args, "path") then text(args["path"]) otherwise "?") + (when contains(args, "line") then ":" + text(args["line"]) + (when contains(args, "character") then ":" + text(args["character"]) otherwise "") otherwise "")
-    when name == "lamp"
-        let lact be when contains(args, "action") then text(args["action"]) otherwise "list"
-        give "lamp " + lact + (when lact != "list" then " " + (when contains(args, "name") then text(args["name"]) otherwise "?") otherwise "") + (when lact == "create" and contains(args, "files") then " [" + join(keys(args["files"]), ", ") + "]" otherwise "")
-    when name == "mcp"
-        let act be when contains(args, "action") then text(args["action"]) otherwise "list"
-        when act == "add"
-            give "mcp add " + (when contains(args, "name") then text(args["name"]) otherwise "?") + "  $ " + one_line(when contains(args, "command") then text(args["command"]) otherwise "?", 120) + " (" + (when contains(args, "scope") then text(args["scope"]) otherwise "global") + ")"
-        when act == "remove"
-            give "mcp remove " + (when contains(args, "name") then text(args["name"]) otherwise "?")
-        give "mcp list"
-    when name == "skill" and is_install(args)
-        give "skill install " + text(args["source"]) + " --skill " + text(args["name"]) + " (" + (when contains(args, "scope") then text(args["scope"]) otherwise "global") + ")"
-    when name == "bash"
-        give "$ " + one_line(when contains(args, "command") then text(args["command"]) otherwise "", 160)
-    when contains(args, "path")
-        give name + " " + text(args["path"])
-    give name + " " + json_encode(args)
+-- lib/permission.syn — política de permisos (allow | deny | ask) sobre las tool calls
+--
+-- Mezcla de los tres harnesses:
+--   * evaluate(tool, args, mode) → allow | deny | ask; "ask" suspende hasta que el humano responde.
+--   * 3 niveles — HARDLINE (nunca, ni en yolo), DANGEROUS (pide aprobación; yolo lo pasa; strict lo niega), resto.
+--
+-- Nota Synsema: el aislamiento de FILESYSTEM ya lo da el lenguaje (file("./*") es el workspace,
+-- call_tool intersecta), así que aquí solo miramos el CONTENIDO de los comandos de shell.
+--
+-- Modos (LAMPSON_PERMISSION): "ask" (default) | "yolo" (dangerous → allow) | "strict" (dangerous → deny)
+
+-- Tier 1: nunca. Coincidencia por substring, case-insensitive.
+-- (el comando se evalúa con un espacio final añadido, así "rm -rf / " matchea la raíz pero NO "rm -rf /tmp/x")
+export let HARDLINE be [
+    "rm -rf / ", "rm -rf /* ", "rm -fr / ", "rm -rf ~ ", "rm -rf ~/ ", "rm -rf * ", "rm -rf . ", "rm -rf ./ ", "rm -rf .. ",
+    "mkfs", "dd if=", ":(){", "fork bomb",
+    "format c:", "del /s /q c:\\", "rd /s /q c:\\", "rmdir /s /q c:\\",
+    "shutdown", "reboot", "> /dev/sda", "chmod -r 777 /",
+    "git push --force origin main", "git push -f origin main", "git push --force origin master"
+]
+
+-- Tier 2: pide aprobación (o deny en strict, allow en yolo).
+export let DANGEROUS be [
+    "rm -rf", "rm -r", "del /s", "rd /s", "rmdir /s", "remove-item -recurse",
+    "git push --force", "git push -f", "git reset --hard", "git clean -f", "git checkout --", "git branch -d",
+    "sudo", "curl | sh", "curl | bash", "wget | sh", "| sh", "| bash",
+    "drop table", "drop database", "truncate table", "delete from",
+    "npm publish", "cargo publish", "pip upload", "twine upload",
+    "docker rm", "docker system prune", "kubectl delete",
+    "chmod", "chown", "> ~/", "crontab",
+    "> .env", ">.env", ">> .env", "tee .env", "> ./.env"
+]
+
+task contains_any(haystack, needles)
+    each n in needles
+        when contains(haystack, lower(n))
+            give n
+    give nothing
+
+-- ¿es un archivo de secretos real? ".env", ".env.local", ".env.production"… sí; ".env.example/.sample/.template" no.
+task is_secret_env(base)
+    when base == ".env"
+        give true
+    when not starts_with(base, ".env.")
+        give false
+    each ok in [".env.example", ".env.sample", ".env.template", ".env.dist", ".env.test.example"]
+        when base == ok
+            give false
+    give true
+
+-- (`and` no cortocircuita en Synsema: indexar args["action"] sin la clave explota → helper con when anidado)
+task is_install(args)
+    when not contains(args, "action")
+        give false
+    give args["action"] == "install"
+
+-- evaluate(tool_name, args, mode) → {decision: "allow"|"deny"|"ask", reason}
+export task evaluate(name, args, mode)
+    when name == "bash"
+        let cmd be (when contains(args, "command") then lower(text(args["command"])) otherwise "") + " "
+        let hard be contains_any(cmd, HARDLINE)
+        when hard != nothing
+            give {"decision": "deny", "reason": "hardline pattern: " + hard}
+        let danger be contains_any(cmd, DANGEROUS)
+        when danger != nothing
+            when mode == "yolo"
+                give {"decision": "allow", "reason": "yolo mode (dangerous: " + danger + ")"}
+            when mode == "strict"
+                give {"decision": "deny", "reason": "strict mode (dangerous: " + danger + ")"}
+            give {"decision": "ask", "reason": "dangerous pattern: " + danger}
+        give {"decision": "allow", "reason": "command"}
+    when name == "write" or name == "edit"
+        -- el scope file("./*") ya impide salir del workspace; aquí solo miramos secretos obvios
+        let p be when contains(args, "path") then lower(replace_text(text(args["path"]), "\\", "/")) otherwise ""
+        let parts be split(p, "/")
+        let base be parts[length(parts) - 1]
+        when is_secret_env(base)
+            when mode == "yolo"
+                give {"decision": "allow", "reason": "yolo mode (.env)"}
+            give {"decision": "ask", "reason": "writes a .env file (secrets)"}
+        give {"decision": "allow", "reason": "workspace write"}
+    when starts_with(name, "mcp_")
+        -- tool de un server MCP (terceros, efectos fuera del workspace): humano por defecto; yolo permite; strict deniega
+        when mode == "yolo"
+            give {"decision": "allow", "reason": "yolo mode (MCP tool)"}
+        when mode == "strict"
+            give {"decision": "deny", "reason": "strict mode (MCP tool)"}
+        give {"decision": "ask", "reason": "MCP tool " + name}
+    when name == "lsp" and contains(args, "op") and text(args["op"]) == "add"
+        -- configurar un language server = el harness va a correr un comando (npx …) del preset: humano siempre
+        when mode == "strict"
+            give {"decision": "deny", "reason": "strict mode (adds an LSP server)"}
+        give {"decision": "ask", "reason": "configures LSP server '" + (when contains(args, "server") then text(args["server"]) otherwise "?") + "' (" + (when contains(args, "scope") then text(args["scope"]) otherwise "global") + ") — it will run the preset command on the first query"}
+    when starts_with(name, "lamp_")
+        -- tool de una lámpara (código del usuario/agente, un proceso por llamada): como las MCP
+        when mode == "yolo"
+            give {"decision": "allow", "reason": "yolo mode (lamp tool)"}
+        when mode == "strict"
+            give {"decision": "deny", "reason": "strict mode (lamp tool)"}
+        give {"decision": "ask", "reason": "lamp tool " + name}
+    when name == "lamp"
+        -- encender una lámpara = autorizar código a correr con las capacidades de su manifiesto: humano SIEMPRE
+        let act be when contains(args, "action") then text(args["action"]) otherwise "list"
+        when act == "enable" or act == "disable"
+            when mode == "strict"
+                give {"decision": "deny", "reason": "strict mode (" + act + " lamp)"}
+            give {"decision": "ask", "reason": act + "s lamp '" + (when contains(args, "name") then text(args["name"]) otherwise "?") + "'"}
+        give {"decision": "allow", "reason": "read-only tool"}
+    when name == "mcp"
+        -- conectar un server MCP = ejecutar un comando de terceros con env propio: humano siempre, incluso en yolo
+        let act be when contains(args, "action") then text(args["action"]) otherwise "list"
+        when act == "add" or act == "remove"
+            when mode == "strict"
+                give {"decision": "deny", "reason": "strict mode (" + act + " MCP server)"}
+            give {"decision": "ask", "reason": act + "s MCP server '" + (when contains(args, "name") then text(args["name"]) otherwise "?") + "'" + (when act == "add" then " → runs: " + (when contains(args, "command") then text(args["command"]) otherwise "?") otherwise "")}
+        give {"decision": "allow", "reason": "read-only tool"}
+    when name == "skill" and is_install(args)
+        -- instala instrucciones/scripts de terceros FUERA del workspace (~/.agents/skills): humano siempre, incluso en yolo
+        when mode == "strict"
+            give {"decision": "deny", "reason": "strict mode (installs a third-party skill)"}
+        give {"decision": "ask", "reason": "installs a third-party skill from " + (when contains(args, "source") then text(args["source"]) otherwise "?") + " (" + (when contains(args, "scope") then text(args["scope"]) otherwise "global") + ")"}
+    give {"decision": "allow", "reason": "read-only tool"}
+
+-- Resumen legible de una tool call, para mostrar al humano antes de aprobar / en el log.
+task one_line(s, max)
+    let t be replace_text(replace_text(s, "\r", ""), "\n", " ⏎ ")
+    when length(t) > max
+        give slice(t, 0, max) + "…"
+    give t
+
+export task describe_call(name, args)
+    when starts_with(name, "mcp_") or starts_with(name, "lamp_")
+        give name + " " + one_line(json_encode(args), 160)
+    when name == "lsp" and contains(args, "op") and text(args["op"]) == "add"
+        give "lsp add " + (when contains(args, "server") then text(args["server"]) otherwise "?") + " (" + (when contains(args, "scope") then text(args["scope"]) otherwise "global") + ")"
+    when name == "lsp"
+        give "lsp " + (when contains(args, "op") then text(args["op"]) otherwise "?") + " " + (when contains(args, "path") then text(args["path"]) otherwise "?") + (when contains(args, "line") then ":" + text(args["line"]) + (when contains(args, "character") then ":" + text(args["character"]) otherwise "") otherwise "")
+    when name == "lamp"
+        let lact be when contains(args, "action") then text(args["action"]) otherwise "list"
+        give "lamp " + lact + (when lact != "list" then " " + (when contains(args, "name") then text(args["name"]) otherwise "?") otherwise "") + (when lact == "create" and contains(args, "files") then " [" + join(keys(args["files"]), ", ") + "]" otherwise "")
+    when name == "mcp"
+        let act be when contains(args, "action") then text(args["action"]) otherwise "list"
+        when act == "add"
+            give "mcp add " + (when contains(args, "name") then text(args["name"]) otherwise "?") + "  $ " + one_line(when contains(args, "command") then text(args["command"]) otherwise "?", 120) + " (" + (when contains(args, "scope") then text(args["scope"]) otherwise "global") + ")"
+        when act == "remove"
+            give "mcp remove " + (when contains(args, "name") then text(args["name"]) otherwise "?")
+        give "mcp list"
+    when name == "skill" and is_install(args)
+        give "skill install " + text(args["source"]) + " --skill " + text(args["name"]) + " (" + (when contains(args, "scope") then text(args["scope"]) otherwise "global") + ")"
+    when name == "bash"
+        give "$ " + one_line(when contains(args, "command") then text(args["command"]) otherwise "", 160)
+    when contains(args, "path")
+        give name + " " + text(args["path"])
+    give name + " " + json_encode(args)

package/lib/prompt.syn

@@ -1,75 +1,75 @@
--- lib/prompt.syn — el system prompt del agente
---
--- Estructura:
---   identidad → reglas de trabajo → uso de tools → entorno (cwd, OS, fecha) → contexto del proyecto
--- El contexto del proyecto se lee de AGENTS.md / LAMPSON.md si existen (convención habitual de los coding agents).
-
-use "./skills.syn" as skills
-use "./tools/memo.syn" as memo
-
-let CONTEXT_FILES be ["AGENTS.md", "LAMPSON.md"]
-
-task read_context_files()
-    require file.read("workspace")
-    require file.read("workspace/*")
-    let out be ""
-    each f in CONTEXT_FILES
-        try
-            let c be read_file("workspace/" + f)
-            set out to out + `\n\n# Project instructions ({f})\n` + c
-        recover err
-            set out to out
-    give out
-
-export task build(env_info, addendum)
-    require file.read("workspace")
-    require file.read("workspace/*")
-    require file.read("skills")
-    require file.read("skills/*")
-    require file.read("memory")
-    require file.read("memory/*")
-    require env("LAMPSON_*")
-    let core be `You are Lampson, a coding agent that works inside the user's project through tools.
-Operate like a careful senior engineer: precise, honest, and economical with words.
-
-# Method — follow these five steps on every non-trivial request
-1. PLAN. If the task needs 3+ distinct steps (not 3 tool calls for one conceptual step), call todo FIRST and keep it current: one item in_progress at a time, marked completed the moment its work is verified — never batched, never on intent. The todo list survives context compaction; your narration does not. Skip it for a single straightforward change; when in doubt, use it.
-2. LOCATE. Find code with grep and find, never by reading directories at random. For a broad, open-ended question about how the codebase works, delegate ONE focused question to an explore sub-agent instead of reading everything yourself — the search stays out of your context. Batch independent lookups into a single turn.
-3. READ ONLY WHAT YOU NEED. Read the files you will change plus the ones you must understand to change them — not the whole project. Every file you read is re-sent on every later call. Use offset/limit for long files, but avoid tiny repeated slices. Trace a symbol to its definition and usages rather than guessing its shape. Never invent files, symbols, APIs or imports — if you have not seen it in this repo, go look. HARD LIMITS enforced by the harness: after 8 read-only calls in a row without acting you get a warning, after 16 read/ls/find/grep are refused until you act; a file read twice unchanged comes back as a one-line receipt.
-4. CHANGE. Act as soon as you know enough — usually within the first 6-10 reads. Prefer edit (exact-string replacement; old_string must be unique, include surrounding context) over write; write only for new files or full rewrites. edit/write on an existing file are rejected unless you read that file in this session and it has not changed since. Minimal, targeted changes: no drive-by refactors, renames or reformatting; add every import or dependency your code needs. Do NOT print code blocks to the user as a substitute for editing — apply the change, then summarise it. If an edit fails to apply, re-read the file and retry with the exact current text; if the same region fails twice, rewrite the enclosing function with write.
-5. VERIFY AND REPORT. Run the relevant tests, linter or build with bash and confirm they pass before claiming the work is done — AFTER your edits, not before as reconnaissance. Never assume a test command: check the README, the package manifest or the project instructions. Finish with a short summary: what changed (files, path:line for specific code) and how you verified it. Do not narrate every step.
-
-# Finishing the job
-- The deliverable is a working artifact backed by real tool output — not a description of one. Do not stop after a stub, a plan or a single command. If a tool, install or network call fails and blocks the real path, say so and try an alternative. NEVER substitute plausible-looking fabricated output for results you could not produce; reporting a blocker honestly beats inventing a result.
-- You MUST use your tools to take action — do not describe what you would do. When you say "I will run the tests" or "let me check the file", make that tool call in the same response. Never end a turn with a promise of future action. Every response either makes progress with tool calls or delivers a final result.
-- When the harness tells you the token budget is nearly exhausted, stop exploring and produce the deliverable from what you already have.
-
-# What NOT to do
-- Never assume a library is available, even a well-known one: check the project manifest and how neighbouring files import it.
-- Do exactly what was asked: no unrequested refactors, no extra features, no gratuitous comments, no new files unless necessary (prefer editing an existing one, including markdown).
-- Do not commit, push or rewrite history unless asked. Never read, print or store secrets — leave .env and credential files alone unless the user asks.
-- If an action is denied by policy or by the user, say so and propose an alternative; never retry the same denied action.
-- Never use placeholders or guess missing parameters in tool calls.
-
-# Tools
-- read (offset/limit), ls, find (glob), grep (regex): use them instead of bash with cat/ls/find/grep — line-numbered and cheaper. lsp (symbols/definition/references/hover): the file's structure without reading it, and exact navigation when grep is ambiguous — prefer lsp symbols plus a ranged read over reading a big file whole. edit: targeted replacement. write: create or fully replace.
-- bash: shell commands from the workspace root. State does not persist between calls (cd resets) — chain with &&. Check the [exit code: N] marker on every result (it is the last line) and investigate failures before moving on. Never pipe a build or test through head/tail: the output is already truncated for you (the full text is saved to a file whose path you get) and the pipe hides the real exit code. Never run a server or watcher here.
-- process: start/logs/stop long-running commands (dev servers, watchers). Their new log lines arrive automatically with every later tool result — do not sleep or poll. Stop what you started when the task is done.
-- delegate: sub-agents with a fresh context (explore, plan, review, worker); several tasks in one call run in parallel, background=true returns at once and the report arrives later as a message. Give a highly detailed, self-contained brief, say whether it should write code or only research, how to verify, and exactly what to return. Its report is a self-report — verify what matters before telling the user it is done. Its output is not visible to the user: summarise it.
-- memory: durable facts across sessions (user preferences, environment details, tool quirks, conventions). Check it before investigating. Write declarative facts, not instructions to yourself; do not store task progress or anything stale in a week.
-- skill: before starting a kind of task, scan the skill list below; if one matches or is even partially relevant, load it and follow it. Err on the side of loading.
-- todo: your task list (whole-list replacement, one in_progress at a time; see Method step 1).
-- MCP tools are named mcp_<server>_<tool>; calling one may ask the user for approval. The mcp tool lists, connects (action=add, with the user's approval) and disconnects servers; a new server's tools enter your catalog on the next turn.
-- Call several independent tools in one turn (reads, searches, read-only commands); serialize only when a later call depends on an earlier result. Tool outputs are truncated at 30k chars — narrow your queries.
-
-# Tone
-Concise and direct; lead with the change or the answer, not a preamble. Prefer technical accuracy over agreeing with the user: investigate before confirming a belief, disagree when the facts warrant it. Communicate only in your response text — never through bash echo or code comments.
-
-# Environment
-- Workspace root (all tool paths are relative to it; you cannot access anything outside it): {env_info["cwd"]}
-- OS: {env_info["os"]}   Shell used by bash tool: {env_info["shell"]}
-- Date: {env_info["date"]}
-- Model: {env_info["model"]} via {env_info["provider"]}
-- The user talks to you from the {env_info["ui"]} UI. When something needs the user's hand (turning a lamp on, adding an LSP server, connecting an MCP), tell them the way that exists in THEIR UI: web → the «lámparas» switch / the LSP and MCP sections of the sidebar; terminal → /lamps on <name>, /lsp add <preset>, /mcp add. Never tell a web user to type a slash command — or simply offer to do it yourself (the tool asks them for approval).`
-    let mode be when addendum == nothing then "" otherwise (when addendum == "" then "" otherwise "\n\n# Mode\n" + addendum)
-    give core + mode + skills.prompt_section(skills.index()) + memo.prompt_section() + read_context_files()
+-- lib/prompt.syn — el system prompt del agente
+--
+-- Estructura:
+--   identidad → reglas de trabajo → uso de tools → entorno (cwd, OS, fecha) → contexto del proyecto
+-- El contexto del proyecto se lee de AGENTS.md / LAMPSON.md si existen (convención habitual de los coding agents).
+
+use "./skills.syn" as skills
+use "./tools/memo.syn" as memo
+
+let CONTEXT_FILES be ["AGENTS.md", "LAMPSON.md"]
+
+task read_context_files()
+    require file.read("workspace")
+    require file.read("workspace/*")
+    let out be ""
+    each f in CONTEXT_FILES
+        try
+            let c be read_file("workspace/" + f)
+            set out to out + `\n\n# Project instructions ({f})\n` + c
+        recover err
+            set out to out
+    give out
+
+export task build(env_info, addendum)
+    require file.read("workspace")
+    require file.read("workspace/*")
+    require file.read("skills")
+    require file.read("skills/*")
+    require file.read("memory")
+    require file.read("memory/*")
+    require env("LAMPSON_*")
+    let core be `You are Lampson, a coding agent that works inside the user's project through tools.
+Operate like a careful senior engineer: precise, honest, and economical with words.
+
+# Method — follow these five steps on every non-trivial request
+1. PLAN. If the task needs 3+ distinct steps (not 3 tool calls for one conceptual step), call todo FIRST and keep it current: one item in_progress at a time, marked completed the moment its work is verified — never batched, never on intent. The todo list survives context compaction; your narration does not. Skip it for a single straightforward change; when in doubt, use it.
+2. LOCATE. Find code with grep and find, never by reading directories at random. For a broad, open-ended question about how the codebase works, delegate ONE focused question to an explore sub-agent instead of reading everything yourself — the search stays out of your context. Batch independent lookups into a single turn.
+3. READ ONLY WHAT YOU NEED. Read the files you will change plus the ones you must understand to change them — not the whole project. Every file you read is re-sent on every later call. Use offset/limit for long files, but avoid tiny repeated slices. Trace a symbol to its definition and usages rather than guessing its shape. Never invent files, symbols, APIs or imports — if you have not seen it in this repo, go look. HARD LIMITS enforced by the harness: after 8 read-only calls in a row without acting you get a warning, after 16 read/ls/find/grep are refused until you act; a file read twice unchanged comes back as a one-line receipt.
+4. CHANGE. Act as soon as you know enough — usually within the first 6-10 reads. Prefer edit (exact-string replacement; old_string must be unique, include surrounding context) over write; write only for new files or full rewrites. edit/write on an existing file are rejected unless you read that file in this session and it has not changed since. Minimal, targeted changes: no drive-by refactors, renames or reformatting; add every import or dependency your code needs. Do NOT print code blocks to the user as a substitute for editing — apply the change, then summarise it. If an edit fails to apply, re-read the file and retry with the exact current text; if the same region fails twice, rewrite the enclosing function with write.
+5. VERIFY AND REPORT. Run the relevant tests, linter or build with bash and confirm they pass before claiming the work is done — AFTER your edits, not before as reconnaissance. Never assume a test command: check the README, the package manifest or the project instructions. Finish with a short summary: what changed (files, path:line for specific code) and how you verified it. Do not narrate every step.
+
+# Finishing the job
+- The deliverable is a working artifact backed by real tool output — not a description of one. Do not stop after a stub, a plan or a single command. If a tool, install or network call fails and blocks the real path, say so and try an alternative. NEVER substitute plausible-looking fabricated output for results you could not produce; reporting a blocker honestly beats inventing a result.
+- You MUST use your tools to take action — do not describe what you would do. When you say "I will run the tests" or "let me check the file", make that tool call in the same response. Never end a turn with a promise of future action. Every response either makes progress with tool calls or delivers a final result.
+- When the harness tells you the token budget is nearly exhausted, stop exploring and produce the deliverable from what you already have.
+
+# What NOT to do
+- Never assume a library is available, even a well-known one: check the project manifest and how neighbouring files import it.
+- Do exactly what was asked: no unrequested refactors, no extra features, no gratuitous comments, no new files unless necessary (prefer editing an existing one, including markdown).
+- Do not commit, push or rewrite history unless asked. Never read, print or store secrets — leave .env and credential files alone unless the user asks.
+- If an action is denied by policy or by the user, say so and propose an alternative; never retry the same denied action.
+- Never use placeholders or guess missing parameters in tool calls.
+
+# Tools
+- read (offset/limit), ls, find (glob), grep (regex): use them instead of bash with cat/ls/find/grep — line-numbered and cheaper. lsp (symbols/definition/references/hover): the file's structure without reading it, and exact navigation when grep is ambiguous — prefer lsp symbols plus a ranged read over reading a big file whole. edit: targeted replacement. write: create or fully replace.
+- bash: shell commands from the workspace root. State does not persist between calls (cd resets) — chain with &&. Check the [exit code: N] marker on every result (it is the last line) and investigate failures before moving on. Never pipe a build or test through head/tail: the output is already truncated for you (the full text is saved to a file whose path you get) and the pipe hides the real exit code. Never run a server or watcher here.
+- process: start/logs/stop long-running commands (dev servers, watchers). Their new log lines arrive automatically with every later tool result — do not sleep or poll. Stop what you started when the task is done.
+- delegate: sub-agents with a fresh context (explore, plan, review, worker); several tasks in one call run in parallel, background=true returns at once and the report arrives later as a message. Give a highly detailed, self-contained brief, say whether it should write code or only research, how to verify, and exactly what to return. Its report is a self-report — verify what matters before telling the user it is done. Its output is not visible to the user: summarise it.
+- memory: durable facts across sessions (user preferences, environment details, tool quirks, conventions). Check it before investigating. Write declarative facts, not instructions to yourself; do not store task progress or anything stale in a week.
+- skill: before starting a kind of task, scan the skill list below; if one matches or is even partially relevant, load it and follow it. Err on the side of loading.
+- todo: your task list (whole-list replacement, one in_progress at a time; see Method step 1).
+- MCP tools are named mcp_<server>_<tool>; calling one may ask the user for approval. The mcp tool lists, connects (action=add, with the user's approval) and disconnects servers; a new server's tools enter your catalog on the next turn.
+- Call several independent tools in one turn (reads, searches, read-only commands); serialize only when a later call depends on an earlier result. Tool outputs are truncated at 30k chars — narrow your queries.
+
+# Tone
+Concise and direct; lead with the change or the answer, not a preamble. Prefer technical accuracy over agreeing with the user: investigate before confirming a belief, disagree when the facts warrant it. Communicate only in your response text — never through bash echo or code comments.
+
+# Environment
+- Workspace root (all tool paths are relative to it; you cannot access anything outside it): {env_info["cwd"]}
+- OS: {env_info["os"]}   Shell used by bash tool: {env_info["shell"]}
+- Date: {env_info["date"]}
+- Model: {env_info["model"]} via {env_info["provider"]}
+- The user talks to you from the {env_info["ui"]} UI. When something needs the user's hand (turning a lamp on, adding an LSP server, connecting an MCP), tell them the way that exists in THEIR UI: web → the «lámparas» switch / the LSP and MCP sections of the sidebar; terminal → /lamps on <name>, /lsp add <preset>, /mcp add. Never tell a web user to type a slash command — or simply offer to do it yourself (the tool asks them for approval).`
+    let mode be when addendum == nothing then "" otherwise (when addendum == "" then "" otherwise "\n\n# Mode\n" + addendum)
+    give core + mode + skills.prompt_section(skills.index()) + memo.prompt_section() + read_context_files()