lampson 0.1.0

package/lib/mcp.syn

@@ -0,0 +1,403 @@
+-- lib/mcp.syn — cliente MCP (Model Context Protocol) por stdio: servers globales y por proyecto
+--
+-- Config (mismo formato que Claude Code / Cursor, para copiar y pegar):
+--   .lampson/mcp.json             GLOBAL: lampson se instala una vez (~/lampson), así que esto vale para
+--                                 TODOS los proyectos que abras — "el mcp de GitHub en todos los repos"
+--   workspace/.lampson/mcp.json   por proyecto (no committeado); un server con el mismo nombre pisa al global
+--   {"mcpServers": {"github": {"command": "npx", "args": ["-y", "@modelcontextprotocol/server-github"],
+--                              "env": {"GITHUB_TOKEN": "…"}, "disabled": false}}}
+--
+-- Arquitectura (la misma que los procesos gestionados, lib/tools/proc.syn):
+--   * un agente supervisor `McpSup` por server: proc_spawn (pipes, una línea JSON por mensaje), handshake
+--     initialize → notifications/initialized → tools/list, y después un loop `select` entre el proceso y
+--     el bus. Vive mientras vive lampson; bajo `serve` sobrevive a los requests. Al cerrar, muere el árbol.
+--   * estado en el blackboard "mcp:<server>" = {status, tools: [{name, description, inputSchema,
+--     readonly}], error}; lo leen chat/web/registry con observe.
+--   * llamada: el tool publica "mcp.req.<server>" {id, method, params} y espera "mcp.res.<server>.<id>";
+--     el supervisor serializa las requests por server (un MCP stdio es secuencial de todos modos).
+--   * cada tool MCP entra al catálogo del modelo como `mcp_<server>_<tool>` con su inputSchema tal cual;
+--     loop.execute las despacha acá (no son tasks Synsema: los args son libres). permission.syn: ask por
+--     defecto (una tool de terceros con efectos fuera del workspace), yolo permite, strict deniega; las
+--     de solo lectura (annotations.readOnlyHint) están también en plan/review/explore.
+-- Sin HTTP/SSE por ahora (stdio cubre casi todos los servers publicados); es el siguiente paso natural.
+
+use "./tools/common.syn" as c
+
+export let GLOBAL_CONFIG be ".lampson/mcp.json"
+export let PROJECT_CONFIG be "workspace/.lampson/mcp.json"
+let CALL_TIMEOUT be 120
+
+task valid_name(name)
+    when name == nothing or name == ""
+        give false
+    give matches(name, "[a-zA-Z0-9_-]{1,32}")
+
+task read_config(path, scope)
+    let out be []
+    try
+        let doc be json_decode(read_file(path))
+        when contains(doc, "mcpServers")
+            each name in keys(doc["mcpServers"])
+                let s be doc["mcpServers"][name]
+                let disabled be false
+                when contains(s, "disabled")
+                    set disabled to s["disabled"] == true
+                when valid_name(name) and contains(s, "command") and not disabled
+                    set out to append(out, {"name": name, "command": text(s["command"]), "args": when contains(s, "args") then s["args"] otherwise [], "env": when contains(s, "env") then s["env"] otherwise {}, "cwd": when contains(s, "cwd") then text(s["cwd"]) otherwise "workspace", "scope": scope})
+    recover err
+        give out
+    give out
+
+-- servers configurados: proyecto pisa a global por nombre. LAMPSON_MCP_CONFIG = un archivo extra (tests).
+export task servers()
+    require file(".lampson")
+    require file(".lampson/*")
+    require file("workspace")
+    require file("workspace/*")
+    require env("LAMPSON_*")
+    let by_name be {}
+    each s in read_config(GLOBAL_CONFIG, "global")
+        set by_name[s["name"]] to s
+    each s in read_config(PROJECT_CONFIG, "project")
+        set by_name[s["name"]] to s
+    when env("LAMPSON_MCP_CONFIG", "") != ""
+        each s in read_config(env("LAMPSON_MCP_CONFIG", ""), "extra")
+            set by_name[s["name"]] to s
+    let out be []
+    each n in sort_by(keys(by_name), (x) => x)
+        set out to append(out, by_name[n])
+    give out
+
+-- ---------- supervisor: un agente por server ----------
+-- Parámetros del spawn: name, command, args_json, env_json, cwd (un agente no ve el módulo: todo va por spawn,
+-- y las constantes PROTOCOL/timeouts van como literales acá adentro).
+agent McpSup
+    require exec
+    require time
+    require env("LAMPSON_*")
+    require env("OS")
+    require file("workspace")
+    require file("workspace/*")
+    let key be "mcp:" + name
+    let args be json_decode(args_json)
+    let envs be json_decode(env_json)
+    share {"status": "starting", "tools": [], "error": nothing, "started": now()} as key
+    let p be nothing
+    try
+        set p to proc_spawn(command, args, {"cwd": cwd, "env": envs, "stderr": "separate", "line_mode": true, "on_full": "drop_oldest"})
+    recover err
+        -- Windows: `npx`/`npm` son .cmd — proc_spawn no pasa por el shell, así que se reintenta con la extensión
+        when env("OS", "") == "Windows_NT" and contains(text(err), "not found") and not contains(lower(command), ".")
+            try
+                set p to proc_spawn(command + ".cmd", args, {"cwd": cwd, "env": envs, "stderr": "separate", "line_mode": true, "on_full": "drop_oldest"})
+            recover err2
+                share {"status": "error", "tools": [], "error": "cannot start: " + text(err2), "started": now()} as key
+        otherwise
+            share {"status": "error", "tools": [], "error": "cannot start: " + text(err), "started": now()} as key
+    when p != nothing
+        let seq be 0
+        let pending be nothing
+        let sub be bus_subscribe(["mcp.req." + name, "mcp.stop." + name, "mcp.stop_all"])
+        -- request síncrona (handshake y tools/list): manda y espera la respuesta con ese id, saltando
+        -- notificaciones y basura; devuelve {result} | {error} | nothing (timeout / proceso muerto)
+        task rpc(method, params, timeout)
+            set seq to seq + 1
+            let id be seq
+            proc_send(p, json_encode({"jsonrpc": "2.0", "id": id, "method": method, "params": params}) + "\n")
+            let deadline be now() + timeout
+            let answer be nothing
+            while answer == nothing and now() < deadline
+                let ev be proc_recv(p, deadline - now())
+                when ev == nothing
+                    set answer to {"error": "timeout waiting for " + method}
+                otherwise when ev["type"] == "exit"
+                    set answer to {"error": "server exited with code " + text(ev["data"]["exit_code"])}
+                otherwise when ev["type"] == "stdout"
+                    try
+                        let m be json_decode(ev["data"])
+                        when contains(m, "id") and m["id"] == id
+                            set answer to when contains(m, "error") then {"error": text(m["error"]["message"])} otherwise {"result": m["result"]}
+                    recover e2
+                        set answer to answer
+            give answer
+        task notify(method, params)
+            proc_send(p, json_encode({"jsonrpc": "2.0", "method": method, "params": params}) + "\n")
+        let init be rpc("initialize", {"protocolVersion": "2025-06-18", "capabilities": {}, "clientInfo": {"name": "lampson", "version": "0.1"}}, 30)
+        when init == nothing or contains(init, "error")
+            share {"status": "error", "tools": [], "error": "initialize failed: " + (when init == nothing then "no answer" otherwise init["error"]), "started": now()} as key
+            proc_close(p)
+        otherwise
+            notify("notifications/initialized", {})
+            let listed be rpc("tools/list", {}, 30)
+            let tools be []
+            when listed != nothing and contains(listed, "result") and contains(listed["result"], "tools")
+                each t in listed["result"]["tools"]
+                    let ro be false
+                    when contains(t, "annotations") and contains(t["annotations"], "readOnlyHint")
+                        set ro to t["annotations"]["readOnlyHint"] == true
+                    set tools to append(tools, {"name": t["name"], "description": when contains(t, "description") then t["description"] otherwise "", "inputSchema": when contains(t, "inputSchema") then t["inputSchema"] otherwise {"type": "object", "properties": {}}, "readonly": ro})
+            share {"status": "ready", "tools": tools, "error": nothing, "started": now()} as key
+            bus_publish("mcp." + name, {"name": name, "status": "ready", "tools": length(tools)})
+            -- loop de servicio: requests por bus, salida/muerte del proceso
+            let open be true
+            while open
+                let ev be select({"p": p, "bus": sub}, 60)
+                when ev == nothing
+                    set open to proc_status(p) == "running"
+                otherwise when ev["name"] == "bus"
+                    when ev["topic"] == "mcp.req." + name
+                        let r be ev["data"]
+                        let ans be rpc(r["method"], r["params"], 120)
+                        bus_publish("mcp.res." + name + "." + text(r["id"]), when ans == nothing then {"error": "no answer"} otherwise ans)
+                    otherwise
+                        set open to false
+                otherwise when ev["type"] == "exit"
+                    share {"status": "exited", "tools": [], "error": "server exited with code " + text(ev["data"]["exit_code"]), "started": now()} as key
+                    bus_publish("mcp." + name, {"name": name, "status": "exited"})
+                    set open to false
+                otherwise when ev["type"] == "stderr"
+                    bus_publish("mcp." + name, {"name": name, "status": "ready", "line": ev["data"]})
+            proc_close(p)
+            when proc_status(p) != "running"
+                observe key as st
+                when st["status"] == "ready"
+                    share {"status": "stopped", "tools": [], "error": nothing, "started": now()} as key
+        bus_unsubscribe(sub)
+
+export task state(name)
+    observe "mcp:" + name as st
+    give st
+
+-- arrancar todos los servers configurados (chat/web al iniciar); espera hasta `wait_s` a que estén listos
+export task start_all(wait_s)
+    require exec
+    require time
+    require env("LAMPSON_*")
+    require env("OS")
+    require file(".lampson")
+    require file(".lampson/*")
+    require file("workspace")
+    require file("workspace/*")
+    let list be servers()
+    each s in list
+        let st be state(s["name"])
+        when st == nothing or (st["status"] != "ready" and st["status"] != "starting")
+            spawn McpSup with name = s["name"], command = s["command"], args_json = json_encode(s["args"]), env_json = json_encode(s["env"]), cwd = s["cwd"]
+    let waited be 0
+    while waited < wait_s * 10 and length(where(list, (s) => state(s["name"]) == nothing or state(s["name"])["status"] == "starting")) > 0
+        sleep(0.1)
+        set waited to waited + 1
+    give list
+
+export task stop_all()
+    bus_publish("mcp.stop_all", {})
+
+-- ---------- conectar / desconectar servers (usuario: web o /mcp add · modelo: tool `mcp`, con aprobación) ----------
+
+-- "npx -y @modelcontextprotocol/server-github" → {command, args[]}; respeta comillas simples y dobles
+-- (rutas de Windows con espacios). No hay expansión de nada: los tokens van tal cual al spawn.
+export task parse_command(line)
+    let toks be []
+    let cur be ""
+    let quote be ""
+    let i be 0
+    let n be length(text(line))
+    while i < n
+        let ch be slice(text(line), i, i + 1)
+        when quote != ""
+            when ch == quote
+                set quote to ""
+            otherwise
+                set cur to cur + ch
+        otherwise when ch == "\"" or ch == "'"
+            set quote to ch
+        otherwise when ch == " " or ch == "\t"
+            when cur != ""
+                set toks to append(toks, cur)
+                set cur to ""
+        otherwise
+            set cur to cur + ch
+        set i to i + 1
+    when cur != ""
+        set toks to append(toks, cur)
+    when length(toks) == 0
+        give {"command": "", "args": []}
+    give {"command": toks[0], "args": slice(toks, 1, length(toks))}
+
+task config_path(scope)
+    give when scope == "project" then PROJECT_CONFIG otherwise GLOBAL_CONFIG
+
+-- alta (o reemplazo) en el mcp.json del scope + arranque del supervisor; devuelve una línea de estado.
+-- El archivo queda en el formato estándar {"mcpServers": {...}} — editable a mano y compatible copy-paste.
+export task add_server(name, command_line, env_map, scope)
+    require exec
+    require time
+    require env("LAMPSON_*")
+    require env("OS")
+    require file(".lampson")
+    require file(".lampson/*")
+    require file("workspace")
+    require file("workspace/*")
+    when not valid_name(name)
+        raise("invalid server name '" + text(name) + "' (letters, digits, - or _, max 32)")
+    let parsed be parse_command(command_line)
+    when parsed["command"] == ""
+        raise("empty command")
+    let sc be when scope == "project" then "project" otherwise "global"
+    let path be config_path(sc)
+    let doc be {"mcpServers": {}}
+    try
+        set doc to json_decode(read_file(path))
+    recover err
+        set doc to {"mcpServers": {}}
+    when not contains(doc, "mcpServers")
+        set doc["mcpServers"] to {}
+    let entry be {"command": parsed["command"], "args": parsed["args"]}
+    when env_map != nothing
+        when length(keys(env_map)) > 0
+            set entry["env"] to env_map
+    let servers_map be doc["mcpServers"]
+    set servers_map[name] to entry
+    set doc["mcpServers"] to servers_map
+    write_file(path, json_encode(doc))
+    -- reconexión: si ya había un supervisor con este nombre, apagarlo antes de arrancar el nuevo
+    let st be state(name)
+    when st != nothing
+        when st["status"] == "ready" or st["status"] == "starting"
+            bus_publish("mcp.stop." + name, {})
+            let w be 0
+            while w < 20 and state(name)["status"] == "ready"
+                sleep(0.1)
+                set w to w + 1
+    start_all(10)
+    let after be state(name)
+    when after == nothing
+        give "added '" + name + "' (" + sc + ") to " + path + " but it did not start — check the command"
+    when after["status"] == "ready"
+        give "connected '" + name + "' (" + sc + "): " + text(length(after["tools"])) + " tools — available as mcp_" + name + "_<tool> from the next turn"
+    give "added '" + name + "' (" + sc + ") but status is " + after["status"] + (when after["error"] != nothing then ": " + text(after["error"]) otherwise "")
+
+-- baja: lo saca del archivo donde esté (de ambos si aparece dos veces) y apaga su supervisor;
+-- las tools mcp_<name>_* desaparecen del catálogo en el próximo turno
+export task remove_server(name)
+    require time
+    require env("LAMPSON_*")
+    require file(".lampson")
+    require file(".lampson/*")
+    require file("workspace")
+    require file("workspace/*")
+    when not valid_name(name)
+        raise("invalid server name")
+    let removed be []
+    each pth in [PROJECT_CONFIG, GLOBAL_CONFIG]
+        try
+            let doc be json_decode(read_file(pth))
+            when contains(doc, "mcpServers")
+                when contains(doc["mcpServers"], name)
+                    let kept be {}
+                    each k in keys(doc["mcpServers"])
+                        when k != name
+                            set kept[k] to doc["mcpServers"][k]
+                    set doc["mcpServers"] to kept
+                    write_file(pth, json_encode(doc))
+                    set removed to append(removed, pth)
+        recover err
+            set removed to removed
+    bus_publish("mcp.stop." + name, {})
+    when length(removed) == 0
+        give "no server named '" + name + "' in " + PROJECT_CONFIG + " or " + GLOBAL_CONFIG
+    give "removed '" + name + "' (" + join(removed, ", ") + ") and stopped its supervisor"
+
+-- [{name, scope, status, error, tools: n}]
+export task summary()
+    require file(".lampson")
+    require file(".lampson/*")
+    require file("workspace")
+    require file("workspace/*")
+    let out be []
+    each s in servers()
+        let st be state(s["name"])
+        set out to append(out, {"name": s["name"], "scope": s["scope"], "command": s["command"] + " " + join(apply((a) => text(a), s["args"]), " "), "status": when st == nothing then "off" otherwise st["status"], "error": when st == nothing then nothing otherwise st["error"], "tools": when st == nothing then [] otherwise apply((t) => t["name"], st["tools"])})
+    give out
+
+-- ---------- tools para el modelo ----------
+
+export task tool_name(server, tool)
+    give "mcp_" + server + "_" + tool
+
+-- catálogo (specs OpenAI-style) de las tools MCP listas; readonly_only = true para perfiles de solo lectura
+export task catalog(readonly_only)
+    require file(".lampson")
+    require file(".lampson/*")
+    require file("workspace")
+    require file("workspace/*")
+    let out be []
+    each s in servers()
+        let st be state(s["name"])
+        when st != nothing and st["status"] == "ready"
+            each t in st["tools"]
+                when t["readonly"] or not readonly_only
+                    set out to append(out, {"name": tool_name(s["name"], t["name"]), "description": "[MCP " + s["name"] + (when t["readonly"] then ", read-only" otherwise "") + "] " + t["description"], "parameters": t["inputSchema"]})
+    give out
+
+export task names(readonly_only)
+    require file(".lampson")
+    require file(".lampson/*")
+    require file("workspace")
+    require file("workspace/*")
+    give apply((s) => s["name"], catalog(readonly_only))
+
+task split_name(full)
+    -- mcp_<server>_<tool>: el server no tiene "_" garantizado, así que probamos cada server configurado
+    let rest be slice(full, 4, length(full))
+    each s in servers()
+        let pre be s["name"] + "_"
+        when length(rest) > length(pre) and slice(rest, 0, length(pre)) == pre
+            give {"server": s["name"], "tool": slice(rest, length(pre), length(rest))}
+    give nothing
+
+-- llamada: request por bus al supervisor, respuesta por bus; el contenido vuelve como texto para el modelo
+export task call(full_name, args)
+    require time
+    require file(".lampson")
+    require file(".lampson/*")
+    require file("workspace")
+    require file("workspace/*")
+    let parts be split_name(full_name)
+    when parts == nothing
+        raise("unknown MCP tool " + full_name)
+    let st be state(parts["server"])
+    when st == nothing or st["status"] != "ready"
+        raise("MCP server '" + parts["server"] + "' is not ready (" + (when st == nothing then "off" otherwise st["status"]) + ")")
+    let id be text(floor(now() * 1000000))
+    let sub be bus_subscribe("mcp.res." + parts["server"] + "." + id)
+    bus_publish("mcp.req." + parts["server"], {"id": id, "method": "tools/call", "params": {"name": parts["tool"], "arguments": when args == nothing then {} otherwise args}})
+    let ev be bus_recv(sub, CALL_TIMEOUT + 5)
+    bus_unsubscribe(sub)
+    when ev == nothing
+        raise("MCP call timed out (" + full_name + ")")
+    let ans be ev["data"]
+    when contains(ans, "error")
+        raise("MCP error: " + text(ans["error"]))
+    give render(ans["result"])
+
+-- resultado MCP → texto: bloques text concatenados; otros tipos se describen; isError → ERROR: …
+task render(result)
+    let parts be []
+    when contains(result, "content")
+        each b in result["content"]
+            let ty be when contains(b, "type") then b["type"] otherwise "?"
+            when ty == "text"
+                set parts to append(parts, text(b["text"]))
+            otherwise when ty == "image"
+                set parts to append(parts, "[image " + (when contains(b, "mimeType") then b["mimeType"] otherwise "") + ", " + text(length(text(b["data"]))) + " base64 chars]")
+            otherwise when ty == "resource"
+                set parts to append(parts, "[resource] " + json_encode(b["resource"]))
+            otherwise
+                set parts to append(parts, json_encode(b))
+    when length(parts) == 0 and contains(result, "structuredContent")
+        set parts to append(parts, json_encode(result["structuredContent"]))
+    let out be join(parts, "\n")
+    when contains(result, "isError") and result["isError"] == true
+        give "ERROR: " + out
+    give c.truncate(out, c.MAX_OUTPUT)

package/lib/permission.syn

@@ -0,0 +1,154 @@
+-- lib/permission.syn — política de permisos (allow | deny | ask) sobre las tool calls
+--
+-- Mezcla de los tres harnesses:
+--   * evaluate(tool, args, mode) → allow | deny | ask; "ask" suspende hasta que el humano responde.
+--   * 3 niveles — HARDLINE (nunca, ni en yolo), DANGEROUS (pide aprobación; yolo lo pasa; strict lo niega), resto.
+--
+-- Nota Synsema: el aislamiento de FILESYSTEM ya lo da el lenguaje (file("./*") es el workspace,
+-- call_tool intersecta), así que aquí solo miramos el CONTENIDO de los comandos de shell.
+--
+-- Modos (LAMPSON_PERMISSION): "ask" (default) | "yolo" (dangerous → allow) | "strict" (dangerous → deny)
+
+-- Tier 1: nunca. Coincidencia por substring, case-insensitive.
+-- (el comando se evalúa con un espacio final añadido, así "rm -rf / " matchea la raíz pero NO "rm -rf /tmp/x")
+export let HARDLINE be [
+    "rm -rf / ", "rm -rf /* ", "rm -fr / ", "rm -rf ~ ", "rm -rf ~/ ", "rm -rf * ", "rm -rf . ", "rm -rf ./ ", "rm -rf .. ",
+    "mkfs", "dd if=", ":(){", "fork bomb",
+    "format c:", "del /s /q c:\\", "rd /s /q c:\\", "rmdir /s /q c:\\",
+    "shutdown", "reboot", "> /dev/sda", "chmod -r 777 /",
+    "git push --force origin main", "git push -f origin main", "git push --force origin master"
+]
+
+-- Tier 2: pide aprobación (o deny en strict, allow en yolo).
+export let DANGEROUS be [
+    "rm -rf", "rm -r", "del /s", "rd /s", "rmdir /s", "remove-item -recurse",
+    "git push --force", "git push -f", "git reset --hard", "git clean -f", "git checkout --", "git branch -d",
+    "sudo", "curl | sh", "curl | bash", "wget | sh", "| sh", "| bash",
+    "drop table", "drop database", "truncate table", "delete from",
+    "npm publish", "cargo publish", "pip upload", "twine upload",
+    "docker rm", "docker system prune", "kubectl delete",
+    "chmod", "chown", "> ~/", "crontab",
+    "> .env", ">.env", ">> .env", "tee .env", "> ./.env"
+]
+
+task contains_any(haystack, needles)
+    each n in needles
+        when contains(haystack, lower(n))
+            give n
+    give nothing
+
+-- ¿es un archivo de secretos real? ".env", ".env.local", ".env.production"… sí; ".env.example/.sample/.template" no.
+task is_secret_env(base)
+    when base == ".env"
+        give true
+    when not starts_with(base, ".env.")
+        give false
+    each ok in [".env.example", ".env.sample", ".env.template", ".env.dist", ".env.test.example"]
+        when base == ok
+            give false
+    give true
+
+-- (`and` no cortocircuita en Synsema: indexar args["action"] sin la clave explota → helper con when anidado)
+task is_install(args)
+    when not contains(args, "action")
+        give false
+    give args["action"] == "install"
+
+-- evaluate(tool_name, args, mode) → {decision: "allow"|"deny"|"ask", reason}
+export task evaluate(name, args, mode)
+    when name == "bash"
+        let cmd be (when contains(args, "command") then lower(text(args["command"])) otherwise "") + " "
+        let hard be contains_any(cmd, HARDLINE)
+        when hard != nothing
+            give {"decision": "deny", "reason": "hardline pattern: " + hard}
+        let danger be contains_any(cmd, DANGEROUS)
+        when danger != nothing
+            when mode == "yolo"
+                give {"decision": "allow", "reason": "yolo mode (dangerous: " + danger + ")"}
+            when mode == "strict"
+                give {"decision": "deny", "reason": "strict mode (dangerous: " + danger + ")"}
+            give {"decision": "ask", "reason": "dangerous pattern: " + danger}
+        give {"decision": "allow", "reason": "command"}
+    when name == "write" or name == "edit"
+        -- el scope file("./*") ya impide salir del workspace; aquí solo miramos secretos obvios
+        let p be when contains(args, "path") then lower(replace_text(text(args["path"]), "\\", "/")) otherwise ""
+        let parts be split(p, "/")
+        let base be parts[length(parts) - 1]
+        when is_secret_env(base)
+            when mode == "yolo"
+                give {"decision": "allow", "reason": "yolo mode (.env)"}
+            give {"decision": "ask", "reason": "writes a .env file (secrets)"}
+        give {"decision": "allow", "reason": "workspace write"}
+    when starts_with(name, "mcp_")
+        -- tool de un server MCP (terceros, efectos fuera del workspace): humano por defecto; yolo permite; strict deniega
+        when mode == "yolo"
+            give {"decision": "allow", "reason": "yolo mode (MCP tool)"}
+        when mode == "strict"
+            give {"decision": "deny", "reason": "strict mode (MCP tool)"}
+        give {"decision": "ask", "reason": "MCP tool " + name}
+    when name == "lsp" and contains(args, "op") and text(args["op"]) == "add"
+        -- configurar un language server = el harness va a correr un comando (npx …) del preset: humano siempre
+        when mode == "strict"
+            give {"decision": "deny", "reason": "strict mode (adds an LSP server)"}
+        give {"decision": "ask", "reason": "configures LSP server '" + (when contains(args, "server") then text(args["server"]) otherwise "?") + "' (" + (when contains(args, "scope") then text(args["scope"]) otherwise "global") + ") — it will run the preset command on the first query"}
+    when starts_with(name, "lamp_")
+        -- tool de una lámpara (código del usuario/agente, un proceso por llamada): como las MCP
+        when mode == "yolo"
+            give {"decision": "allow", "reason": "yolo mode (lamp tool)"}
+        when mode == "strict"
+            give {"decision": "deny", "reason": "strict mode (lamp tool)"}
+        give {"decision": "ask", "reason": "lamp tool " + name}
+    when name == "lamp"
+        -- encender una lámpara = autorizar código a correr con las capacidades de su manifiesto: humano SIEMPRE
+        let act be when contains(args, "action") then text(args["action"]) otherwise "list"
+        when act == "enable" or act == "disable"
+            when mode == "strict"
+                give {"decision": "deny", "reason": "strict mode (" + act + " lamp)"}
+            give {"decision": "ask", "reason": act + "s lamp '" + (when contains(args, "name") then text(args["name"]) otherwise "?") + "'"}
+        give {"decision": "allow", "reason": "read-only tool"}
+    when name == "mcp"
+        -- conectar un server MCP = ejecutar un comando de terceros con env propio: humano siempre, incluso en yolo
+        let act be when contains(args, "action") then text(args["action"]) otherwise "list"
+        when act == "add" or act == "remove"
+            when mode == "strict"
+                give {"decision": "deny", "reason": "strict mode (" + act + " MCP server)"}
+            give {"decision": "ask", "reason": act + "s MCP server '" + (when contains(args, "name") then text(args["name"]) otherwise "?") + "'" + (when act == "add" then " → runs: " + (when contains(args, "command") then text(args["command"]) otherwise "?") otherwise "")}
+        give {"decision": "allow", "reason": "read-only tool"}
+    when name == "skill" and is_install(args)
+        -- instala instrucciones/scripts de terceros FUERA del workspace (~/.agents/skills): humano siempre, incluso en yolo
+        when mode == "strict"
+            give {"decision": "deny", "reason": "strict mode (installs a third-party skill)"}
+        give {"decision": "ask", "reason": "installs a third-party skill from " + (when contains(args, "source") then text(args["source"]) otherwise "?") + " (" + (when contains(args, "scope") then text(args["scope"]) otherwise "global") + ")"}
+    give {"decision": "allow", "reason": "read-only tool"}
+
+-- Resumen legible de una tool call, para mostrar al humano antes de aprobar / en el log.
+task one_line(s, max)
+    let t be replace_text(replace_text(s, "\r", ""), "\n", " ⏎ ")
+    when length(t) > max
+        give slice(t, 0, max) + "…"
+    give t
+
+export task describe_call(name, args)
+    when starts_with(name, "mcp_") or starts_with(name, "lamp_")
+        give name + " " + one_line(json_encode(args), 160)
+    when name == "lsp" and contains(args, "op") and text(args["op"]) == "add"
+        give "lsp add " + (when contains(args, "server") then text(args["server"]) otherwise "?") + " (" + (when contains(args, "scope") then text(args["scope"]) otherwise "global") + ")"
+    when name == "lsp"
+        give "lsp " + (when contains(args, "op") then text(args["op"]) otherwise "?") + " " + (when contains(args, "path") then text(args["path"]) otherwise "?") + (when contains(args, "line") then ":" + text(args["line"]) + (when contains(args, "character") then ":" + text(args["character"]) otherwise "") otherwise "")
+    when name == "lamp"
+        let lact be when contains(args, "action") then text(args["action"]) otherwise "list"
+        give "lamp " + lact + (when lact != "list" then " " + (when contains(args, "name") then text(args["name"]) otherwise "?") otherwise "") + (when lact == "create" and contains(args, "files") then " [" + join(keys(args["files"]), ", ") + "]" otherwise "")
+    when name == "mcp"
+        let act be when contains(args, "action") then text(args["action"]) otherwise "list"
+        when act == "add"
+            give "mcp add " + (when contains(args, "name") then text(args["name"]) otherwise "?") + "  $ " + one_line(when contains(args, "command") then text(args["command"]) otherwise "?", 120) + " (" + (when contains(args, "scope") then text(args["scope"]) otherwise "global") + ")"
+        when act == "remove"
+            give "mcp remove " + (when contains(args, "name") then text(args["name"]) otherwise "?")
+        give "mcp list"
+    when name == "skill" and is_install(args)
+        give "skill install " + text(args["source"]) + " --skill " + text(args["name"]) + " (" + (when contains(args, "scope") then text(args["scope"]) otherwise "global") + ")"
+    when name == "bash"
+        give "$ " + one_line(when contains(args, "command") then text(args["command"]) otherwise "", 160)
+    when contains(args, "path")
+        give name + " " + text(args["path"])
+    give name + " " + json_encode(args)

package/lib/prompt.syn

@@ -0,0 +1,75 @@
+-- lib/prompt.syn — el system prompt del agente
+--
+-- Estructura:
+--   identidad → reglas de trabajo → uso de tools → entorno (cwd, OS, fecha) → contexto del proyecto
+-- El contexto del proyecto se lee de AGENTS.md / LAMPSON.md si existen (convención habitual de los coding agents).
+
+use "./skills.syn" as skills
+use "./tools/memo.syn" as memo
+
+let CONTEXT_FILES be ["AGENTS.md", "LAMPSON.md"]
+
+task read_context_files()
+    require file.read("workspace")
+    require file.read("workspace/*")
+    let out be ""
+    each f in CONTEXT_FILES
+        try
+            let c be read_file("workspace/" + f)
+            set out to out + `\n\n# Project instructions ({f})\n` + c
+        recover err
+            set out to out
+    give out
+
+export task build(env_info, addendum)
+    require file.read("workspace")
+    require file.read("workspace/*")
+    require file.read("skills")
+    require file.read("skills/*")
+    require file.read("memory")
+    require file.read("memory/*")
+    require env("LAMPSON_*")
+    let core be `You are Lampson, a coding agent that works inside the user's project through tools.
+Operate like a careful senior engineer: precise, honest, and economical with words.
+
+# Method — follow these five steps on every non-trivial request
+1. PLAN. If the task needs 3+ distinct steps (not 3 tool calls for one conceptual step), call todo FIRST and keep it current: one item in_progress at a time, marked completed the moment its work is verified — never batched, never on intent. The todo list survives context compaction; your narration does not. Skip it for a single straightforward change; when in doubt, use it.
+2. LOCATE. Find code with grep and find, never by reading directories at random. For a broad, open-ended question about how the codebase works, delegate ONE focused question to an explore sub-agent instead of reading everything yourself — the search stays out of your context. Batch independent lookups into a single turn.
+3. READ ONLY WHAT YOU NEED. Read the files you will change plus the ones you must understand to change them — not the whole project. Every file you read is re-sent on every later call. Use offset/limit for long files, but avoid tiny repeated slices. Trace a symbol to its definition and usages rather than guessing its shape. Never invent files, symbols, APIs or imports — if you have not seen it in this repo, go look. HARD LIMITS enforced by the harness: after 8 read-only calls in a row without acting you get a warning, after 16 read/ls/find/grep are refused until you act; a file read twice unchanged comes back as a one-line receipt.
+4. CHANGE. Act as soon as you know enough — usually within the first 6-10 reads. Prefer edit (exact-string replacement; old_string must be unique, include surrounding context) over write; write only for new files or full rewrites. edit/write on an existing file are rejected unless you read that file in this session and it has not changed since. Minimal, targeted changes: no drive-by refactors, renames or reformatting; add every import or dependency your code needs. Do NOT print code blocks to the user as a substitute for editing — apply the change, then summarise it. If an edit fails to apply, re-read the file and retry with the exact current text; if the same region fails twice, rewrite the enclosing function with write.
+5. VERIFY AND REPORT. Run the relevant tests, linter or build with bash and confirm they pass before claiming the work is done — AFTER your edits, not before as reconnaissance. Never assume a test command: check the README, the package manifest or the project instructions. Finish with a short summary: what changed (files, path:line for specific code) and how you verified it. Do not narrate every step.
+
+# Finishing the job
+- The deliverable is a working artifact backed by real tool output — not a description of one. Do not stop after a stub, a plan or a single command. If a tool, install or network call fails and blocks the real path, say so and try an alternative. NEVER substitute plausible-looking fabricated output for results you could not produce; reporting a blocker honestly beats inventing a result.
+- You MUST use your tools to take action — do not describe what you would do. When you say "I will run the tests" or "let me check the file", make that tool call in the same response. Never end a turn with a promise of future action. Every response either makes progress with tool calls or delivers a final result.
+- When the harness tells you the token budget is nearly exhausted, stop exploring and produce the deliverable from what you already have.
+
+# What NOT to do
+- Never assume a library is available, even a well-known one: check the project manifest and how neighbouring files import it.
+- Do exactly what was asked: no unrequested refactors, no extra features, no gratuitous comments, no new files unless necessary (prefer editing an existing one, including markdown).
+- Do not commit, push or rewrite history unless asked. Never read, print or store secrets — leave .env and credential files alone unless the user asks.
+- If an action is denied by policy or by the user, say so and propose an alternative; never retry the same denied action.
+- Never use placeholders or guess missing parameters in tool calls.
+
+# Tools
+- read (offset/limit), ls, find (glob), grep (regex): use them instead of bash with cat/ls/find/grep — line-numbered and cheaper. lsp (symbols/definition/references/hover): the file's structure without reading it, and exact navigation when grep is ambiguous — prefer lsp symbols plus a ranged read over reading a big file whole. edit: targeted replacement. write: create or fully replace.
+- bash: shell commands from the workspace root. State does not persist between calls (cd resets) — chain with &&. Check the [exit code: N] marker on every result (it is the last line) and investigate failures before moving on. Never pipe a build or test through head/tail: the output is already truncated for you (the full text is saved to a file whose path you get) and the pipe hides the real exit code. Never run a server or watcher here.
+- process: start/logs/stop long-running commands (dev servers, watchers). Their new log lines arrive automatically with every later tool result — do not sleep or poll. Stop what you started when the task is done.
+- delegate: sub-agents with a fresh context (explore, plan, review, worker); several tasks in one call run in parallel, background=true returns at once and the report arrives later as a message. Give a highly detailed, self-contained brief, say whether it should write code or only research, how to verify, and exactly what to return. Its report is a self-report — verify what matters before telling the user it is done. Its output is not visible to the user: summarise it.
+- memory: durable facts across sessions (user preferences, environment details, tool quirks, conventions). Check it before investigating. Write declarative facts, not instructions to yourself; do not store task progress or anything stale in a week.
+- skill: before starting a kind of task, scan the skill list below; if one matches or is even partially relevant, load it and follow it. Err on the side of loading.
+- todo: your task list (whole-list replacement, one in_progress at a time; see Method step 1).
+- MCP tools are named mcp_<server>_<tool>; calling one may ask the user for approval. The mcp tool lists, connects (action=add, with the user's approval) and disconnects servers; a new server's tools enter your catalog on the next turn.
+- Call several independent tools in one turn (reads, searches, read-only commands); serialize only when a later call depends on an earlier result. Tool outputs are truncated at 30k chars — narrow your queries.
+
+# Tone
+Concise and direct; lead with the change or the answer, not a preamble. Prefer technical accuracy over agreeing with the user: investigate before confirming a belief, disagree when the facts warrant it. Communicate only in your response text — never through bash echo or code comments.
+
+# Environment
+- Workspace root (all tool paths are relative to it; you cannot access anything outside it): {env_info["cwd"]}
+- OS: {env_info["os"]}   Shell used by bash tool: {env_info["shell"]}
+- Date: {env_info["date"]}
+- Model: {env_info["model"]} via {env_info["provider"]}
+- The user talks to you from the {env_info["ui"]} UI. When something needs the user's hand (turning a lamp on, adding an LSP server, connecting an MCP), tell them the way that exists in THEIR UI: web → the «lámparas» switch / the LSP and MCP sections of the sidebar; terminal → /lamps on <name>, /lsp add <preset>, /mcp add. Never tell a web user to type a slash command — or simply offer to do it yourself (the tool asks them for approval).`
+    let mode be when addendum == nothing then "" otherwise (when addendum == "" then "" otherwise "\n\n# Mode\n" + addendum)
+    give core + mode + skills.prompt_section(skills.index()) + memo.prompt_section() + read_context_files()