lampson 0.1.0 → 0.1.2

package/lib/md.syn

@@ -0,0 +1,171 @@
+-- lib/md.syn — markdown → ANSI para la terminal (sin dependencias)
+--   render(md, color) → texto listo para print. color=false → texto plano legible (sin escapes).
+--   inline(s, color)  → solo formato inline (negrita, cursiva, `código`, links, ~~tachado~~).
+-- MIGA: `matches` es full-match; para buscar/reemplazar son `capture`/`find_all`/`replace_re`
+-- (backrefs \1). En strings "..." la barra va simple ("\*", "\d"): "\\d" NO es \d.
+-- Los bloques ``` se copian tal cual (sin parseo inline). La web ya renderiza markdown por su cuenta.
+
+let ESC be decode(bytes("1b", "hex"))
+let WIDTH be 72
+
+task sgr(color, code, s)
+    when not color or s == ""
+        give s
+    give ESC + "[" + code + "m" + s + ESC + "[0m"
+
+task rep(ch, n)
+    let out be ""
+    while length(out) < n
+        set out to out + ch
+    give out
+
+-- ---------- inline ----------
+
+task emphasis(s, color)
+    let out be s
+    -- links [texto](url) → texto url  (antes que la cursiva: la url puede traer _ o *)
+    set out to replace_re(out, "\[([^\]]+)\]\(([^)]+)\)", sgr(color, "4", "\1") + sgr(color, "2", " \2"))
+    set out to replace_re(out, "\*\*([^*]+)\*\*", sgr(color, "1", "\1"))
+    set out to replace_re(out, "__([^_]+)__", sgr(color, "1", "\1"))
+    set out to replace_re(out, "~~([^~]+)~~", sgr(color, "9", "\1"))
+    -- cursiva: *x* solo si no está pegada a texto/número (2*3 no es cursiva). Dos pasadas:
+    -- el grupo \3 consume el separador, así que "*a* *b*" necesita la segunda.
+    let pass be 0
+    while pass < 2
+        set out to replace_re(out, "(^|[^\w*])\*([^*\s][^*]*?)\*($|[^\w*])", "\1" + sgr(color, "3", "\2") + "\3")
+        set out to replace_re(out, "(^|[^\w_])_([^_\s][^_]*?)_($|[^\w_])", "\1" + sgr(color, "3", "\2") + "\3")
+        set pass to pass + 1
+    give out
+
+export task inline(s, color)
+    -- `código` primero: lo de adentro no se toca
+    let parts be split(s, "`")
+    when length(parts) < 3
+        give emphasis(s, color)
+    let out be ""
+    let idx be 0
+    each p in parts
+        when idx == length(parts) - 1 and idx % 2 == 1
+            set out to out + "`" + emphasis(p, color)
+        otherwise when idx % 2 == 1
+            set out to out + sgr(color, "33", p)
+        otherwise
+            set out to out + emphasis(p, color)
+        set idx to idx + 1
+    give out
+
+-- ---------- bloques ----------
+
+task indent_of(line)
+    let n be 0
+    while n < length(line) and slice(line, n, n + 1) == " "
+        set n to n + 1
+    give n
+
+task table_cells(line)
+    let t be trim(line)
+    when starts_with(t, "|")
+        set t to slice(t, 1, length(t))
+    when ends_with(t, "|")
+        set t to slice(t, 0, length(t) - 1)
+    give apply(trim, split(t, "|"))
+
+-- rows: lista de listas de celdas (crudas); la primera es el header. Columnas alineadas al ancho
+-- máximo de cada una (ancho visible = length de inline(c, false), sin escapes ni marcas).
+task table_lines(rows, pre, color)
+    let widths be []
+    each r in rows
+        let i be 0
+        each c in r
+            when i >= length(widths)
+                set widths to append(widths, 0)
+            when length(inline(c, false)) > widths[i]
+                set widths[i] to length(inline(c, false))
+            set i to i + 1
+    let out be []
+    let ri be 0
+    each r in rows
+        let cells be []
+        let i be 0
+        each c in r
+            let fill be rep(" ", widths[i] - length(inline(c, false)))
+            set cells to append(cells, (when ri == 0 then sgr(color, "1", inline(c, color)) otherwise inline(c, color)) + fill)
+            set i to i + 1
+        set out to append(out, pre + join(cells, sgr(color, "2", " │ ")))
+        when ri == 0
+            let segs be []
+            each w in widths
+                set segs to append(segs, rep("─", w))
+            set out to append(out, pre + sgr(color, "2", join(segs, "─┼─")))
+        set ri to ri + 1
+    give out
+
+task fence_top(lang, color)
+    let label be when lang != "" then " " + lang + " " otherwise ""
+    give sgr(color, "2", "┌──" + label + rep("─", WIDTH - 3 - length(label)))
+
+export task render(md, color)
+    let pre be "  "
+    let out be []
+    let in_code be false
+    let fence be ""
+    let table be []
+    each line in split(md, "\n")
+        let t be trim(line)
+        let heading be capture(t, "^(#{1,6}) (.+)$")
+        let item be capture(t, "^(\d{1,3})[.)] (.*)$")
+        let is_row be starts_with(t, "|") and ends_with(t, "|") and not in_code
+        when length(table) > 0 and not is_row
+            each l in table_lines(table, pre, color)
+                set out to append(out, l)
+            set table to []
+        when in_code
+            when starts_with(t, fence)
+                set in_code to false
+                set out to append(out, pre + sgr(color, "2", "└" + rep("─", WIDTH - 1)))
+            otherwise
+                set out to append(out, pre + sgr(color, "2", "│ ") + sgr(color, "36", line))
+        otherwise when starts_with(t, "```") or starts_with(t, "~~~")
+            set in_code to true
+            set fence to slice(t, 0, 3)
+            set out to append(out, pre + fence_top(trim(slice(t, 3, length(t))), color))
+        otherwise when heading != nothing
+            let lvl be length(heading[0])
+            let raw be trim(heading[1])
+            let title be inline(raw, color)
+            set out to append(out, "")
+            when lvl == 1
+                set out to append(out, pre + sgr(color, "1;36", upper(title)))
+                set out to append(out, pre + sgr(color, "36", rep("═", length(raw))))
+            otherwise when lvl == 2
+                set out to append(out, pre + sgr(color, "1;36", title))
+                set out to append(out, pre + sgr(color, "2;36", rep("─", length(raw))))
+            otherwise
+                set out to append(out, pre + sgr(color, "1", title))
+        otherwise when matches(t, "(-{3,}|\*{3,}|_{3,})")
+            set out to append(out, pre + sgr(color, "2", rep("─", WIDTH)))
+        otherwise when starts_with(t, ">")
+            set out to append(out, pre + sgr(color, "2", "▎ ") + sgr(color, "3", inline(trim(slice(t, 1, length(t))), color)))
+        otherwise when matches(t, "\|[\s:|-]+\|")
+            set table to table
+        otherwise when is_row
+            set table to append(table, table_cells(t))
+        otherwise when starts_with(t, "- ") or starts_with(t, "* ") or starts_with(t, "+ ") or item != nothing
+            let ind be rep(" ", indent_of(line))
+            let mark be when item != nothing then sgr(color, "36", item[0] + ".") otherwise sgr(color, "36", "•")
+            let rest be when item != nothing then item[1] otherwise slice(t, 2, length(t))
+            when starts_with(rest, "[ ] ")
+                set mark to sgr(color, "2", "☐")
+                set rest to slice(rest, 4, length(rest))
+            otherwise when starts_with(rest, "[x] ") or starts_with(rest, "[X] ")
+                set mark to sgr(color, "32", "☑")
+                set rest to slice(rest, 4, length(rest))
+            set out to append(out, pre + ind + mark + " " + inline(rest, color))
+        otherwise
+            set out to append(out, when t == "" then "" otherwise pre + inline(line, color))
+    when length(table) > 0
+        each l in table_lines(table, pre, color)
+            set out to append(out, l)
+    when in_code
+        set out to append(out, pre + sgr(color, "2", "└" + rep("─", WIDTH - 1)))
+    give join(out, "\n")

package/lib/permission.syn

@@ -1,154 +1,189 @@
--- lib/permission.syn — política de permisos (allow | deny | ask) sobre las tool calls
---
--- Mezcla de los tres harnesses:
---   * evaluate(tool, args, mode) → allow | deny | ask; "ask" suspende hasta que el humano responde.
---   * 3 niveles — HARDLINE (nunca, ni en yolo), DANGEROUS (pide aprobación; yolo lo pasa; strict lo niega), resto.
---
--- Nota Synsema: el aislamiento de FILESYSTEM ya lo da el lenguaje (file("./*") es el workspace,
--- call_tool intersecta), así que aquí solo miramos el CONTENIDO de los comandos de shell.
---
--- Modos (LAMPSON_PERMISSION): "ask" (default) | "yolo" (dangerous → allow) | "strict" (dangerous → deny)
-
--- Tier 1: nunca. Coincidencia por substring, case-insensitive.
--- (el comando se evalúa con un espacio final añadido, así "rm -rf / " matchea la raíz pero NO "rm -rf /tmp/x")
-export let HARDLINE be [
-    "rm -rf / ", "rm -rf /* ", "rm -fr / ", "rm -rf ~ ", "rm -rf ~/ ", "rm -rf * ", "rm -rf . ", "rm -rf ./ ", "rm -rf .. ",
-    "mkfs", "dd if=", ":(){", "fork bomb",
-    "format c:", "del /s /q c:\\", "rd /s /q c:\\", "rmdir /s /q c:\\",
-    "shutdown", "reboot", "> /dev/sda", "chmod -r 777 /",
-    "git push --force origin main", "git push -f origin main", "git push --force origin master"
-]
-
--- Tier 2: pide aprobación (o deny en strict, allow en yolo).
-export let DANGEROUS be [
-    "rm -rf", "rm -r", "del /s", "rd /s", "rmdir /s", "remove-item -recurse",
-    "git push --force", "git push -f", "git reset --hard", "git clean -f", "git checkout --", "git branch -d",
-    "sudo", "curl | sh", "curl | bash", "wget | sh", "| sh", "| bash",
-    "drop table", "drop database", "truncate table", "delete from",
-    "npm publish", "cargo publish", "pip upload", "twine upload",
-    "docker rm", "docker system prune", "kubectl delete",
-    "chmod", "chown", "> ~/", "crontab",
-    "> .env", ">.env", ">> .env", "tee .env", "> ./.env"
-]
-
-task contains_any(haystack, needles)
-    each n in needles
-        when contains(haystack, lower(n))
-            give n
-    give nothing
-
--- ¿es un archivo de secretos real? ".env", ".env.local", ".env.production"… sí; ".env.example/.sample/.template" no.
-task is_secret_env(base)
-    when base == ".env"
-        give true
-    when not starts_with(base, ".env.")
-        give false
-    each ok in [".env.example", ".env.sample", ".env.template", ".env.dist", ".env.test.example"]
-        when base == ok
-            give false
-    give true
-
--- (`and` no cortocircuita en Synsema: indexar args["action"] sin la clave explota → helper con when anidado)
-task is_install(args)
-    when not contains(args, "action")
-        give false
-    give args["action"] == "install"
-
--- evaluate(tool_name, args, mode) → {decision: "allow"|"deny"|"ask", reason}
-export task evaluate(name, args, mode)
-    when name == "bash"
-        let cmd be (when contains(args, "command") then lower(text(args["command"])) otherwise "") + " "
-        let hard be contains_any(cmd, HARDLINE)
-        when hard != nothing
-            give {"decision": "deny", "reason": "hardline pattern: " + hard}
-        let danger be contains_any(cmd, DANGEROUS)
-        when danger != nothing
-            when mode == "yolo"
-                give {"decision": "allow", "reason": "yolo mode (dangerous: " + danger + ")"}
-            when mode == "strict"
-                give {"decision": "deny", "reason": "strict mode (dangerous: " + danger + ")"}
-            give {"decision": "ask", "reason": "dangerous pattern: " + danger}
-        give {"decision": "allow", "reason": "command"}
-    when name == "write" or name == "edit"
-        -- el scope file("./*") ya impide salir del workspace; aquí solo miramos secretos obvios
-        let p be when contains(args, "path") then lower(replace_text(text(args["path"]), "\\", "/")) otherwise ""
-        let parts be split(p, "/")
-        let base be parts[length(parts) - 1]
-        when is_secret_env(base)
-            when mode == "yolo"
-                give {"decision": "allow", "reason": "yolo mode (.env)"}
-            give {"decision": "ask", "reason": "writes a .env file (secrets)"}
-        give {"decision": "allow", "reason": "workspace write"}
-    when starts_with(name, "mcp_")
-        -- tool de un server MCP (terceros, efectos fuera del workspace): humano por defecto; yolo permite; strict deniega
-        when mode == "yolo"
-            give {"decision": "allow", "reason": "yolo mode (MCP tool)"}
-        when mode == "strict"
-            give {"decision": "deny", "reason": "strict mode (MCP tool)"}
-        give {"decision": "ask", "reason": "MCP tool " + name}
-    when name == "lsp" and contains(args, "op") and text(args["op"]) == "add"
-        -- configurar un language server = el harness va a correr un comando (npx …) del preset: humano siempre
-        when mode == "strict"
-            give {"decision": "deny", "reason": "strict mode (adds an LSP server)"}
-        give {"decision": "ask", "reason": "configures LSP server '" + (when contains(args, "server") then text(args["server"]) otherwise "?") + "' (" + (when contains(args, "scope") then text(args["scope"]) otherwise "global") + ") — it will run the preset command on the first query"}
-    when starts_with(name, "lamp_")
-        -- tool de una lámpara (código del usuario/agente, un proceso por llamada): como las MCP
-        when mode == "yolo"
-            give {"decision": "allow", "reason": "yolo mode (lamp tool)"}
-        when mode == "strict"
-            give {"decision": "deny", "reason": "strict mode (lamp tool)"}
-        give {"decision": "ask", "reason": "lamp tool " + name}
-    when name == "lamp"
-        -- encender una lámpara = autorizar código a correr con las capacidades de su manifiesto: humano SIEMPRE
-        let act be when contains(args, "action") then text(args["action"]) otherwise "list"
-        when act == "enable" or act == "disable"
-            when mode == "strict"
-                give {"decision": "deny", "reason": "strict mode (" + act + " lamp)"}
-            give {"decision": "ask", "reason": act + "s lamp '" + (when contains(args, "name") then text(args["name"]) otherwise "?") + "'"}
-        give {"decision": "allow", "reason": "read-only tool"}
-    when name == "mcp"
-        -- conectar un server MCP = ejecutar un comando de terceros con env propio: humano siempre, incluso en yolo
-        let act be when contains(args, "action") then text(args["action"]) otherwise "list"
-        when act == "add" or act == "remove"
-            when mode == "strict"
-                give {"decision": "deny", "reason": "strict mode (" + act + " MCP server)"}
-            give {"decision": "ask", "reason": act + "s MCP server '" + (when contains(args, "name") then text(args["name"]) otherwise "?") + "'" + (when act == "add" then " → runs: " + (when contains(args, "command") then text(args["command"]) otherwise "?") otherwise "")}
-        give {"decision": "allow", "reason": "read-only tool"}
-    when name == "skill" and is_install(args)
-        -- instala instrucciones/scripts de terceros FUERA del workspace (~/.agents/skills): humano siempre, incluso en yolo
-        when mode == "strict"
-            give {"decision": "deny", "reason": "strict mode (installs a third-party skill)"}
-        give {"decision": "ask", "reason": "installs a third-party skill from " + (when contains(args, "source") then text(args["source"]) otherwise "?") + " (" + (when contains(args, "scope") then text(args["scope"]) otherwise "global") + ")"}
-    give {"decision": "allow", "reason": "read-only tool"}
-
--- Resumen legible de una tool call, para mostrar al humano antes de aprobar / en el log.
-task one_line(s, max)
-    let t be replace_text(replace_text(s, "\r", ""), "\n", " ⏎ ")
-    when length(t) > max
-        give slice(t, 0, max) + "…"
-    give t
-
-export task describe_call(name, args)
-    when starts_with(name, "mcp_") or starts_with(name, "lamp_")
-        give name + " " + one_line(json_encode(args), 160)
-    when name == "lsp" and contains(args, "op") and text(args["op"]) == "add"
-        give "lsp add " + (when contains(args, "server") then text(args["server"]) otherwise "?") + " (" + (when contains(args, "scope") then text(args["scope"]) otherwise "global") + ")"
-    when name == "lsp"
-        give "lsp " + (when contains(args, "op") then text(args["op"]) otherwise "?") + " " + (when contains(args, "path") then text(args["path"]) otherwise "?") + (when contains(args, "line") then ":" + text(args["line"]) + (when contains(args, "character") then ":" + text(args["character"]) otherwise "") otherwise "")
-    when name == "lamp"
-        let lact be when contains(args, "action") then text(args["action"]) otherwise "list"
-        give "lamp " + lact + (when lact != "list" then " " + (when contains(args, "name") then text(args["name"]) otherwise "?") otherwise "") + (when lact == "create" and contains(args, "files") then " [" + join(keys(args["files"]), ", ") + "]" otherwise "")
-    when name == "mcp"
-        let act be when contains(args, "action") then text(args["action"]) otherwise "list"
-        when act == "add"
-            give "mcp add " + (when contains(args, "name") then text(args["name"]) otherwise "?") + "  $ " + one_line(when contains(args, "command") then text(args["command"]) otherwise "?", 120) + " (" + (when contains(args, "scope") then text(args["scope"]) otherwise "global") + ")"
-        when act == "remove"
-            give "mcp remove " + (when contains(args, "name") then text(args["name"]) otherwise "?")
-        give "mcp list"
-    when name == "skill" and is_install(args)
-        give "skill install " + text(args["source"]) + " --skill " + text(args["name"]) + " (" + (when contains(args, "scope") then text(args["scope"]) otherwise "global") + ")"
-    when name == "bash"
-        give "$ " + one_line(when contains(args, "command") then text(args["command"]) otherwise "", 160)
-    when contains(args, "path")
-        give name + " " + text(args["path"])
-    give name + " " + json_encode(args)
+-- lib/permission.syn — política de permisos (allow | deny | ask) sobre las tool calls
+--
+-- Mezcla de los tres harnesses:
+--   * evaluate(tool, args, mode) → allow | deny | ask; "ask" suspende hasta que el humano responde.
+--   * 3 niveles — HARDLINE (nunca, ni en yolo), DANGEROUS (pide aprobación; yolo lo pasa; strict lo niega), resto.
+--
+-- Nota Synsema: el aislamiento de FILESYSTEM ya lo da el lenguaje (file("./*") es el workspace,
+-- call_tool intersecta), así que aquí solo miramos el CONTENIDO de los comandos de shell.
+--
+-- Modos (LAMPSON_PERMISSION): "ask" (default) | "yolo" (dangerous → allow) | "strict" (dangerous → deny)
+
+-- Tier 1: nunca. Coincidencia por substring, case-insensitive.
+-- (el comando se evalúa con un espacio final añadido, así "rm -rf / " matchea la raíz pero NO "rm -rf /tmp/x")
+export let HARDLINE be [
+    "rm -rf / ", "rm -rf /* ", "rm -fr / ", "rm -rf ~ ", "rm -rf ~/ ", "rm -rf * ", "rm -rf . ", "rm -rf ./ ", "rm -rf .. ",
+    "mkfs", "dd if=", ":(){", "fork bomb",
+    "format c:", "del /s /q c:\\", "rd /s /q c:\\", "rmdir /s /q c:\\",
+    "shutdown", "reboot", "> /dev/sda", "chmod -r 777 /",
+    "git push --force origin main", "git push -f origin main", "git push --force origin master"
+]
+
+-- Tier 2: pide aprobación (o deny en strict, allow en yolo).
+export let DANGEROUS be [
+    "rm -rf", "rm -r", "del /s", "rd /s", "rmdir /s", "remove-item -recurse",
+    "git push --force", "git push -f", "git reset --hard", "git clean -f", "git checkout --", "git branch -d",
+    "sudo", "curl | sh", "curl | bash", "wget | sh", "| sh", "| bash",
+    "drop table", "drop database", "truncate table", "delete from",
+    "npm publish", "cargo publish", "pip upload", "twine upload",
+    "docker rm", "docker system prune", "kubectl delete",
+    "chmod", "chown", "> ~/", "crontab",
+    "> .env", ">.env", ">> .env", "tee .env", "> ./.env"
+]
+
+task contains_any(haystack, needles)
+    each n in needles
+        when contains(haystack, lower(n))
+            give n
+    give nothing
+
+-- ¿es un archivo de secretos real? ".env", ".env.local", ".env.production"… sí; ".env.example/.sample/.template" no.
+task is_secret_env(base)
+    when base == ".env"
+        give true
+    when not starts_with(base, ".env.")
+        give false
+    each ok in [".env.example", ".env.sample", ".env.template", ".env.dist", ".env.test.example"]
+        when base == ok
+            give false
+    give true
+
+-- (`and` no cortocircuita en Synsema: indexar args["action"] sin la clave explota → helper con when anidado)
+task is_install(args)
+    when not contains(args, "action")
+        give false
+    give args["action"] == "install"
+
+-- evaluate(tool_name, args, mode) → {decision: "allow"|"deny"|"ask", reason}
+export task evaluate(name, args, mode)
+    when name == "bash"
+        let cmd be (when contains(args, "command") then lower(text(args["command"])) otherwise "") + " "
+        let hard be contains_any(cmd, HARDLINE)
+        when hard != nothing
+            give {"decision": "deny", "reason": "hardline pattern: " + hard}
+        let danger be contains_any(cmd, DANGEROUS)
+        when danger != nothing
+            when mode == "yolo"
+                give {"decision": "allow", "reason": "yolo mode (dangerous: " + danger + ")"}
+            when mode == "strict"
+                give {"decision": "deny", "reason": "strict mode (dangerous: " + danger + ")"}
+            give {"decision": "ask", "reason": "dangerous pattern: " + danger}
+        give {"decision": "allow", "reason": "command"}
+    when name == "write" or name == "edit"
+        -- el scope file("./*") ya impide salir del workspace; aquí solo miramos secretos obvios
+        let p be when contains(args, "path") then lower(replace_text(text(args["path"]), "\\", "/")) otherwise ""
+        let parts be split(p, "/")
+        let base be parts[length(parts) - 1]
+        when is_secret_env(base)
+            when mode == "yolo"
+                give {"decision": "allow", "reason": "yolo mode (.env)"}
+            give {"decision": "ask", "reason": "writes a .env file (secrets)"}
+        give {"decision": "allow", "reason": "workspace write"}
+    when starts_with(name, "mcp_")
+        -- tool de un server MCP (terceros, efectos fuera del workspace): humano por defecto; yolo permite; strict deniega
+        when mode == "yolo"
+            give {"decision": "allow", "reason": "yolo mode (MCP tool)"}
+        when mode == "strict"
+            give {"decision": "deny", "reason": "strict mode (MCP tool)"}
+        give {"decision": "ask", "reason": "MCP tool " + name}
+    when name == "lsp" and contains(args, "op") and text(args["op"]) == "add"
+        -- configurar un language server = el harness va a correr un comando (npx …) del preset: humano siempre
+        when mode == "strict"
+            give {"decision": "deny", "reason": "strict mode (adds an LSP server)"}
+        give {"decision": "ask", "reason": "configures LSP server '" + (when contains(args, "server") then text(args["server"]) otherwise "?") + "' (" + (when contains(args, "scope") then text(args["scope"]) otherwise "global") + ") — it will run the preset command on the first query"}
+    when starts_with(name, "lamp_")
+        -- tool de una lámpara (código del usuario/agente, un proceso por llamada): como las MCP
+        when mode == "yolo"
+            give {"decision": "allow", "reason": "yolo mode (lamp tool)"}
+        when mode == "strict"
+            give {"decision": "deny", "reason": "strict mode (lamp tool)"}
+        give {"decision": "ask", "reason": "lamp tool " + name}
+    when name == "lamp"
+        -- encender una lámpara = autorizar código a correr con las capacidades de su manifiesto: humano SIEMPRE
+        let act be when contains(args, "action") then text(args["action"]) otherwise "list"
+        when act == "enable" or act == "disable"
+            when mode == "strict"
+                give {"decision": "deny", "reason": "strict mode (" + act + " lamp)"}
+            give {"decision": "ask", "reason": act + "s lamp '" + (when contains(args, "name") then text(args["name"]) otherwise "?") + "'"}
+        give {"decision": "allow", "reason": "read-only tool"}
+    when name == "mcp"
+        -- conectar un server MCP = ejecutar un comando de terceros con env propio: humano siempre, incluso en yolo
+        let act be when contains(args, "action") then text(args["action"]) otherwise "list"
+        when act == "add" or act == "remove"
+            when mode == "strict"
+                give {"decision": "deny", "reason": "strict mode (" + act + " MCP server)"}
+            give {"decision": "ask", "reason": act + "s MCP server '" + (when contains(args, "name") then text(args["name"]) otherwise "?") + "'" + (when act == "add" then " → runs: " + (when contains(args, "command") then text(args["command"]) otherwise "?") otherwise "")}
+        give {"decision": "allow", "reason": "read-only tool"}
+    when name == "skill" and is_install(args)
+        -- instala instrucciones/scripts de terceros FUERA del workspace (~/.agents/skills): humano siempre, incluso en yolo
+        when mode == "strict"
+            give {"decision": "deny", "reason": "strict mode (installs a third-party skill)"}
+        give {"decision": "ask", "reason": "installs a third-party skill from " + (when contains(args, "source") then text(args["source"]) otherwise "?") + " (" + (when contains(args, "scope") then text(args["scope"]) otherwise "global") + ")"}
+    give {"decision": "allow", "reason": "read-only tool"}
+
+-- Resumen legible de una tool call, para mostrar al humano antes de aprobar / en el log.
+task one_line(s, max)
+    let t be replace_text(replace_text(s, "\r", ""), "\n", " ⏎ ")
+    when length(t) > max
+        give slice(t, 0, max) + "…"
+    give t
+
+export task describe_call(name, args)
+    when starts_with(name, "mcp_") or starts_with(name, "lamp_")
+        give name + " " + one_line(json_encode(args), 160)
+    when name == "lsp" and contains(args, "op") and text(args["op"]) == "add"
+        give "lsp add " + (when contains(args, "server") then text(args["server"]) otherwise "?") + " (" + (when contains(args, "scope") then text(args["scope"]) otherwise "global") + ")"
+    when name == "lsp"
+        give "lsp " + (when contains(args, "op") then text(args["op"]) otherwise "?") + " " + (when contains(args, "path") then text(args["path"]) otherwise "?") + (when contains(args, "line") then ":" + text(args["line"]) + (when contains(args, "character") then ":" + text(args["character"]) otherwise "") otherwise "")
+    when name == "lamp"
+        let lact be when contains(args, "action") then text(args["action"]) otherwise "list"
+        give "lamp " + lact + (when lact != "list" then " " + (when contains(args, "name") then text(args["name"]) otherwise "?") otherwise "") + (when lact == "create" and contains(args, "files") then " [" + join(keys(args["files"]), ", ") + "]" otherwise "")
+    when name == "mcp"
+        let act be when contains(args, "action") then text(args["action"]) otherwise "list"
+        when act == "add"
+            give "mcp add " + (when contains(args, "name") then text(args["name"]) otherwise "?") + "  $ " + one_line(when contains(args, "command") then text(args["command"]) otherwise "?", 120) + " (" + (when contains(args, "scope") then text(args["scope"]) otherwise "global") + ")"
+        when act == "remove"
+            give "mcp remove " + (when contains(args, "name") then text(args["name"]) otherwise "?")
+        give "mcp list"
+    when name == "skill" and is_install(args)
+        give "skill install " + text(args["source"]) + " --skill " + text(args["name"]) + " (" + (when contains(args, "scope") then text(args["scope"]) otherwise "global") + ")"
+    when name == "bash"
+        give "$ " + one_line(when contains(args, "command") then text(args["command"]) otherwise "", 160)
+    -- lectura/búsqueda: como lo escribiría un humano en la shell
+    when name == "read"
+        let rng be when contains(args, "offset") or contains(args, "limit") then "  (" + (when contains(args, "offset") then "desde " + text(floor(number(text(args["offset"])))) otherwise "") + (when contains(args, "limit") then " " + text(floor(number(text(args["limit"])))) + " líneas" otherwise "") + ")" otherwise ""
+        give "read " + arg(args, "path", ".") + rng
+    when name == "ls"
+        give "ls " + arg(args, "path", ".")
+    when name == "find"
+        give "find " + arg(args, "pattern", "*") + (when contains(args, "path") then "  en " + text(args["path"]) otherwise "")
+    when name == "grep"
+        let flags be (when contains(args, "regex") and args["regex"] == true then " -E" otherwise "") + (when contains(args, "glob") then " --glob " + text(args["glob"]) otherwise "")
+        give "grep" + flags + " \"" + one_line(arg(args, "pattern", ""), 80) + "\"" + (when contains(args, "path") then "  " + text(args["path"]) otherwise "")
+    when name == "edit"
+        give "edit " + arg(args, "path", "?")
+    when name == "write"
+        give "write " + arg(args, "path", "?") + (when contains(args, "content") then dim_len(text(args["content"])) otherwise "")
+    when name == "memory"
+        let mact be arg(args, "action", "list")
+        give "memory " + mact + (when contains(args, "name") then " " + text(args["name"]) otherwise "") + (when (mact == "write" or mact == "append") and contains(args, "content") then "  — " + one_line(text(args["content"]), 70) otherwise "")
+    when name == "process"
+        let pact be arg(args, "action", "list")
+        give "process " + pact + (when contains(args, "name") then " " + text(args["name"]) otherwise "") + (when contains(args, "command") then "  $ " + one_line(text(args["command"]), 100) otherwise "")
+    when name == "skill"
+        give "skill " + arg(args, "action", "load") + " " + arg(args, "name", "?")
+    when name == "todo"
+        let n be when contains(args, "items") then length(args["items"]) otherwise 0
+        let done be when contains(args, "items") then length(where(args["items"], (i) => contains(i, "status") and text(i["status"]) == "done")) otherwise 0
+        give "todo  " + text(done) + "/" + text(n) + " hechas"
+    when contains(args, "path")
+        give name + " " + text(args["path"])
+    give name + " " + one_line(json_encode(args), 160)
+
+task arg(args, key, default)
+    when contains(args, key)
+        give text(args[key])
+    give default
+
+task dim_len(s)
+    give "  (" + text(length(split(s, "\n"))) + " líneas)"