lampson 0.1.3 → 0.2.0

package/.env.example

@@ -27,3 +27,12 @@ LAMPSON_API_KEY=sk-...
 
 # Reanudar una sesión en chat.syn
 # LAMPSON_SESSION=20260826-233000
+
+# Tareas programadas y aprobaciones a distancia (proceso residente: lampson --daemon start)
+# LAMPSON_TZ=-03:00              # zona horaria para "daily 09:00" (default: la del sistema, `date +%z`)
+# LAMPSON_PUBLIC_URL=https://lampson.midominio.com   # URL por la que se llega a este lampson desde afuera (túnel, VPS,
+#                                # edge Synsema con TLS): con esto cada aprobación pendiente trae links de un solo uso
+#                                # (GET /approve/<id>/<token>?d=yes|no) para decidir desde el móvil
+# LAMPSON_WEBHOOK_URL=https://hooks.example.com/lampson   # POST JSON por cada aprobación pendiente (id, mensaje, links);
+#                                # reenvialo a Telegram/Slack/mail con n8n, un bot o un .syn de 6 líneas
+# LAMPSON_WEBHOOK_SECRET=…       # firma HMAC-SHA256 del body (X-Lampson-Signature: sha256=<hex>)

package/README.md

@@ -4,7 +4,10 @@
 reads, searches, edits and runs commands through tools that are confined to that project by the
 language itself — and every step is visible, in the terminal or in a web UI.
 
-- **Terminal or web**: `lampson` (REPL) or `lampson --web` (http://127.0.0.1:8080).
+- **Workspaces, always on**: every project folder is a *workspace* with its own process (sessions, scheduled tasks,
+  MCP, lamps, dev servers), all behind one hub at http://127.0.0.1:8080 — open several at once and switch without
+  killing the others. `lampson` (terminal) and `lampson --web` (browser) open the workspace of the current folder;
+  `lampson --install` keeps the hub alive across logins.
 - **Any OpenAI- or Anthropic-compatible API** over raw HTTP: DeepSeek, Kimi, Groq, Grok, OpenRouter,
   Ollama, Anthropic, MiniMax… one `.env` line to switch.
 - **Least-privilege by construction**: each tool declares its capabilities; the runtime enforces
@@ -29,6 +32,14 @@ language itself — and every step is visible, in the terminal or in a web UI.
   under a capability ceiling, or any executable (js, py, sh…). Global in `lampson/lamps/<name>/`, per
   project in `.lampson/lamps/<name>/` (the agent can write those). **Off by default**: you turn them on
   from the top bar of the web UI or `/lamps on <name>`; their tools join the catalog as `lamp_<lamp>_<tool>`.
+- **Scheduled tasks**: "every 6h", "daily 09:00", "mon,wed 08:30" — a lamp tool, a fixed shell command, or a
+  full unattended agent run from a prompt with a permission envelope fixed when you create it (`strict` /
+  `ask` / `yolo`). They run inside Lampson's resident process (`lampson --daemon start`, or the open web UI),
+  the run's session shows up as `⏰ name`, and a webhook can receive each result (for "search and send me" tasks).
+- **Approvals from anywhere**: an unattended run that hits something dangerous waits for you — in the web UI
+  («Aprobaciones»), and, with `LAMPSON_PUBLIC_URL` + `LAMPSON_WEBHOOK_URL`, through a signed webhook carrying
+  one-time **decision links** you can open from your phone (Telegram, mail, Slack…). Never auto-approved:
+  no answer in time = denied.
 - **Project memory**: the agent keeps its own notes per project (`memory/<project>/*.md`, outside
   the repo) — how to run it, gotchas, decisions — and rereads them in the next session. You can read
   and edit them (web panel, `/memory`).
@@ -116,6 +127,68 @@ does the same with persistent sessions and memory.
 > Status: developed and tested on Windows 11; the Docker image (Ubuntu 24.04) is built by CI. The Linux/macOS
 > installer is written but not yet exercised on a real machine — issues welcome.
 
+## Workspaces and the hub (how it runs)
+
+```
+lampson                         # in a project folder: registers it as a workspace (first time), makes sure the hub and
+                                # the workspace's process are up, opens the terminal on it
+lampson --web                   # same, then opens http://127.0.0.1:8080/w/<slug> in the browser
+http://127.0.0.1:8080           # the workspaces screen: open one, create one (native folder dialog; a server-side
+                                # browser on a VPS), turn them on/off, life policy
+lampson --hub start|stop|status|logs|restart
+lampson --install               # Windows: Scheduled Task at logon · Linux: systemd --user unit (Restart=always)
+```
+
+Why processes: in Synsema a tool's file capability is a literal path relative to the process cwd, so a workspace is
+a directory `~/lampson/.lampson/ws/<slug>/` with a junction `workspace` → your project (plus junctions to the
+install's `lib/`, `public/`, `skills/`, `lamps/`, `memory/`), and its own `.lampson/` state. Its process
+(`synsema serve web.syn --port 808N --bind 127.0.0.1`) only ever sees that folder. The hub (`hub.syn`, generated
+from `hub.tpl.syn`, one proxy route per workspace) is the only listener you use: it serves the UI and forwards
+`/w/<slug>/api/…` — SSE and the WebSocket terminal included (Synsema ≥ 0.6.12). Workspace processes are detached
+from the hub, so a hub restart never kills them. The hub is also the supervisor: every 15 s it starts what should
+be alive and stops what is idle (⚙ → hours of inactivity, `0` = never; a workspace with enabled scheduled tasks or
+policy «siempre vivo» stays up).
+
+On a VPS put the hub behind your domain (`synsema serve hub.syn --port 443 --domain … --tls-auto …` or your
+edge); workspace ports never leave loopback. `LAMPSON_PUBLIC_URL` = `https://host` and approval links carry
+`/w/<slug>` automatically.
+
+## Scheduled tasks and the resident process
+
+Lampson can run things with nobody at the keyboard. Scheduled tasks run inside the workspace's process (the hub
+keeps it alive while it has enabled tasks) — or inside the terminal REPL when no process is up (a background thread
+ticks every 30 s). `lampson --install` makes the hub survive reboots.
+
+Timezone, public URL and webhook are set from the ⚙ button of the web header (tabs: General · Aprobaciones a
+distancia · Proveedor; stored in `lampson/.lampson/config.json`, `.env` wins) or from `.env`.
+
+Create a task from the chat («todos los días a las 9 corré los tests y avisame» — the agent calls the
+`schedule` tool and asks you to approve the task, showing exactly what will run and with which permissions),
+from the web sidebar («Programadas» → +), or from the terminal (`/schedule add <json>`). Three kinds:
+
+| kind | what runs | authorization |
+|---|---|---|
+| `lamp` | a tool of a lamp that is ON | turning the lamp on |
+| `bash` | one fixed command (must finish on its own) | approved once, at creation |
+| `prompt` | a full agent turn with your instructions and a profile (`build` / `review` / `plan` / `explore`) | the permission envelope: `strict` (dangerous → denied), `ask` (dangerous → approval request, denied if unanswered within `approval_timeout`, 2 h by default), `yolo` |
+
+Schedules: `every 6h` · `every 30m` · `daily 09:00` · `mon,wed 08:30` · `weekdays 09:00` (local time; `LAMPSON_TZ`
+overrides). Synsema's `cron_every` is a pure interval, so a 30 s tick in `web.syn` translates it to wall-clock time;
+a run missed while the daemon was down executes when it comes back and is marked as late. State lives in
+`.lampson/schedules.json`, logs in `.lampson/schedules/<id>.log`; a `prompt` run also leaves a normal session (`⏰ name`)
+with its trace. `notify` = a webhook URL that receives each result as JSON.
+
+**Approving from your phone.** Set `LAMPSON_PUBLIC_URL` (how this Lampson is reached from outside — a tunnel, a VPS,
+or a Synsema edge with TLS in front) and `LAMPSON_WEBHOOK_URL` (+ `LAMPSON_WEBHOOK_SECRET`, HMAC-SHA256 in
+`X-Lampson-Signature`). Every pending approval — from a scheduled run or from the chat — POSTs `{id, message, why,
+expires_at, respond_link_yes, respond_link_no}`; forward the links wherever you read (n8n, a bot, a 6-line `.syn`).
+`GET /approve/<id>/<token>?d=yes|no` is public on purpose: the 32-byte one-time token is the authorization, and it
+dies with the deadline. `GET /api/approvals` (loopback) lists what is pending, never the tokens.
+
+For a real server use systemd (`synsema serve web.syn`, `Restart=always`) instead of `synsema daemon`, which has no
+boot start / crash restart. One box, several projects: one `web.syn` per project on its own port, behind a Synsema
+edge that terminates TLS and routes by host (see the Synsema deploy docs).
+
 ## Use
 
 ```bash
@@ -182,10 +255,20 @@ run Lampson in a container.
 ## Architecture
 
 ```
-lampson.ps1 / .sh    launcher: mounts ./workspace, starts terminal or web
+lampson.ps1 / .sh    launcher: resolves the workspace (cli.syn), ensures hub + process, opens terminal or browser
+cli.syn              what launchers ask Synsema: ensure/list/hub-start/hub-stop/hub-restart (last line = JSON)
+hub.tpl.syn          template of the hub (:8080): workspaces screen + API, supervisor tick, one proxy route per workspace
+lib/workspaces.syn   registry (.lampson/workspaces.json), ws/<slug> dirs + junctions, detached processes, health,
+                     life policy, folder picker (native dialog / server-side browser)
 chat.syn             terminal REPL (colors, approvals via Synsema's native `approve`)
-web.syn              HTTP server: POST /api/chat → SSE events; sessions, tree, file viewer, processes, ports
-public/index.html    web UI (no build step, no dependencies)
+web.syn              one process per workspace: /w/:slug/api/… → SSE chat, sessions, tree, processes, schedules…
+public/              web UI (no build step, no dependencies; classic scripts served by `static`)
+  index.html         markup only: header, the two side panels, the chat; loads css/ and js/ in order
+  css/               tokens (fonts, palette, base) · layout (grid, header, panels, chat, composer) · sidebar · chat · panel
+  js/core.js         shared state + helpers ($, esc, md, add, api, showPane/showText, inlineConfirm, debounce, empty)
+  js/panel.js        THE modal component: one shell, three layouts (browse = search + list + detail, tabs, form)
+  js/<view>.js       one file per thing on screen: sessions, chat, tree, terminal, procs, agents, memory, todo,
+                     mcp, lsp, lamps, schedules, approvals, config (+ provider), update, events (SSE), app (boot)
 lib/
   provider.syn       config from .env · chat(cfg, messages, catalog) · retry with backoff
   loop.syn           run_turn(): LLM → tool calls → permissions → call_tool → results → repeat; doom-loop guard; compaction

package/bin/lampson.js

@@ -22,7 +22,7 @@ const home = process.env.LAMPSON_HOME || path.join(os.homedir(), 'lampson');
 const marker = path.join(home, '.npm-installed');
 
 // what gets copied into the home: the runtime, never state. Keep in sync with "files" in package.json.
-const CODE = ['lib', 'public', 'skills', 'chat.syn', 'web.syn', 'lampson.ps1', 'lampson.sh', 'lampson.cmd', '.env.example', 'README.md', 'LICENSE'];
+const CODE = ['lib', 'public', 'skills', 'chat.syn', 'web.syn', 'hub.tpl.syn', 'cli.syn', 'lampson.ps1', 'lampson.sh', 'lampson.cmd', '.env.example', 'README.md', 'LICENSE'];
 
 // copia un archivo; en unix, los scripts de shell y los .syn salen con LF aunque el paquete se haya armado
 // en Windows (un CRLF en lampson.sh rompe bash: "set: pipefail\r: invalid option")

package/chat.syn

@@ -14,6 +14,7 @@ require net
 require time
 require stdin
 require exec
+require random
 require env("LAMPSON_*")
 require env("OS")
 require secret("LAMPSON_*")
@@ -51,6 +52,9 @@ use "./lib/mcp.syn" as mcp
 use "./lib/lamps.syn" as lamps
 use "./lib/lsp.syn" as lsp
 use "./lib/tools/todo.syn" as todo
+use "./lib/schedule.syn" as schedule
+use "./lib/sched_run.syn" as sched_run
+use "./lib/approvals.syn" as approvals
 
 -- ---------- UI de terminal ----------
 -- Colores ANSI (Windows Terminal, PowerShell 7, cualquier terminal moderna). LAMPSON_NO_COLOR=1 los apaga.
@@ -344,6 +348,8 @@ let COMMANDS be [
     ["/mcp", "[add <nombre> <comando…> [--project] | remove <nombre>]", "servers MCP: listar, conectar o quitar (global: lampson/.lampson/mcp.json · proyecto: .lampson/mcp.json)"],
     ["/lamps", "[on <nombre> | off <nombre> | run <lámpara> <tool> [json] | remove <nombre>]", "lámparas (plugins de tools): listar, encender o apagar (global: lampson/lamps/ · proyecto: .lampson/lamps/)"],
     ["/lsp", "[add <typescript|python|rust|go|css|html> [--project] | add <nombre> <comando…> --ext .x=lang | remove <nombre>]", "language servers (navegación semántica: symbols/definition/references/hover); arrancan en la primera consulta"],
+    ["/schedule", "[add <json> | run <id> | on <id> | off <id> | remove <id> | log <id>]", "tareas programadas (cada 6h, todos los días a las 9…): lámpara, comando o corrida del agente; corren mientras lampson esté abierto (o con lampson --daemon start, sin nada abierto)"],
+    ["/approve", "<id> yes|no", "responder una aprobación pendiente de una tarea programada que corre en background"],
     ["/out", "[n]", "resultado completo de la última tool del turno (n = contar hacia atrás: /out 2 es la anteúltima)"],
     ["/verbose", "", "alternar: mostrar SIEMPRE el output completo de cada tool (queda guardado en config.json)"],
     ["/trace", "[n]", "traza legible de esta sesión (pasos, tools, tiempos, tokens, errores): .lampson/trace/<sesión>.log"],
@@ -403,6 +409,16 @@ task complete_args(cmd, head, last)
         when trim(head) == "add"
             give sort_by(keys(lsp.PRESETS), (x) => x)
         give ["--project", "--ext"]
+    when cmd == "/approve"
+        when first
+            give apply((a) => a["id"], approvals.pending())
+        give ["yes", "no"]
+    when cmd == "/schedule"
+        when first
+            give ["add", "run", "on", "off", "remove", "log"]
+        when starts_with(trim(head), "add")
+            give []
+        give apply((s) => s["id"], schedule.summary())
     when cmd == "/agent"
         give ["build", "plan", "review", "explore", "worker"]
     when cmd == "/model"
@@ -672,6 +688,57 @@ task opts_for(p, mode)
 task lampson_subagent(spec_json)
     give agents.run_child_json(spec_json)
 
+-- Tareas programadas TAMBIÉN en la terminal: `cron_every` no corre mientras el hilo principal está en el teclado,
+-- pero un `agent` sí (hilo real, como el Spinner). Cada 30 s llama al tick (heartbeat + corridas vencidas); una
+-- corrida `prompt` transcurre al lado del chat sin tocar su sesión (blackboard lampson:sched:session) y si pide
+-- permiso lo dice por consola: /approve <id> yes|no (o link/webhook si están configurados).
+task lampson_sched_tick()
+    give sched_run.tick()
+
+agent Sched
+    require net
+    require time
+    require exec
+    require random
+    require env("LAMPSON_*")
+    require env("OS")
+    require secret("LAMPSON_*")
+    require file("workspace")
+    require file("workspace/*")
+    require file.read("skills")
+    require file.read("skills/*")
+    require file.read("lamps")
+    require file.read("lamps/*")
+    require file("memory")
+    require file("memory/*")
+    require file(".lampson")
+    require file(".lampson/*")
+    let alive be true
+    let waited be 25
+    while alive
+        observe "lampson:spinner:stop" as st
+        when st == true
+            set alive to false
+        otherwise when waited >= 30
+            set waited to 0
+            try
+                -- bajo el hub el proceso del workspace (LAMPSON_PORT) ya hace tick: no duplicar corridas
+                let port be env("LAMPSON_PORT", "")
+                let other be false
+                when port != ""
+                    try
+                        let hr be http_get("http://127.0.0.1:" + port + "/w/" + env("LAMPSON_WS", "x") + "/api/health", {"timeout": 2})
+                        set other to hr["ok"]
+                    recover e2
+                        set other to false
+                when not other
+                    lampson_sched_tick()
+            recover err
+                print("[lampson] scheduler: " + text(err))
+        otherwise
+            sleep(1)
+            set waited to waited + 1
+
 -- !comando del usuario en un pseudo-terminal: la salida se ve EN VIVO y, si el proceso se queda esperando
 -- (prompt y/N, contraseña, REPL, `npm init`…), lo que escribas se le manda como teclas + Enter.
 -- Enter vacío = seguir esperando · ^C = cortar. Devuelve la salida (sin ANSI) para el contexto del agente.
@@ -765,6 +832,7 @@ banner(env_info["cwd"], cfg, profile, opts["permission_mode"], sid)
 share nothing as "lampson:busy"
 share false as "lampson:spinner:stop"
 spawn Spinner with esc = ESC, color = COLOR
+spawn Sched
 flush()
 
 let total_usage be {"input": 0, "output": 0}
@@ -1005,6 +1073,71 @@ while running
                 each s in ss
                     print("  " + (when s["status"] == "ready" then green("● ") otherwise (when s["status"] == "error" or s["status"] == "exited" then red("○ ") otherwise dim("○ "))) + pad(s["name"], 12) + dim(pad(s["scope"], 8) + pad(s["status"], 8) + join(s["extensions"], " ") + "  $ " + s["command"]) + (when s["error"] != nothing then red("  " + text(s["error"])) otherwise ""))
                 print("  " + dim("idle = arranca en la primera consulta del agente"))
+        otherwise when input == "/schedule" or starts_with(input, "/schedule ")
+            -- tareas programadas (lib/schedule.syn). Crear: JSON, o pedírselo al agente ("todos los días a las 9 corré…").
+            -- Las corre el daemon (web.syn con `lampson --daemon start`); `/schedule run` las corre acá mismo, con
+            -- el menú de aprobación de la terminal si la tarea es `ask`.
+            let srest be trim(slice(input, 9, length(input)))
+            let stoks be where(split(srest, " "), (x) => x != "")
+            let sact be when length(stoks) > 0 then stoks[0] otherwise ""
+            let sid_arg be when length(stoks) > 1 then stoks[1] otherwise ""
+            when sact == "add"
+                let sjson be trim(slice(srest, 3, length(srest)))
+                when sjson == ""
+                    print("  uso: /schedule add {\"name\": \"…\", \"when\": \"daily 09:00\", \"action\": {\"type\": \"bash\", \"command\": \"npm test\"}, \"permission\": \"ask\"}")
+                    print("  " + dim("when: every 6h · daily 09:00 · mon,wed 08:30 · weekdays 09:00   action.type: lamp {lamp, tool, args} · bash {command} · prompt {prompt, agent}"))
+                    print("  " + dim("o pedíselo al agente en lenguaje natural: «todos los días a las 9 revisá los tests y avisame»"))
+                otherwise
+                    try
+                        let st be schedule.add(json_decode(sjson))
+                        print("  " + green("⏰ programada «" + st["name"] + "» (" + st["id"] + "): " + schedule.describe_plan(st["plan"]) + " · próxima " + schedule.fmt_local(st["next_run"])))
+                    recover err
+                        print("  " + red(text(err)))
+            otherwise when sact == "run" and sid_arg != ""
+                let st be schedule.get(sid_arg)
+                when st == nothing
+                    print("  " + red("no existe la tarea " + sid_arg))
+                otherwise
+                    print("  " + yellow("⏰ corriendo «" + st["name"] + "» · " + schedule.describe_action(st["action"])))
+                    flush()
+                    let sr be sched_run.run(st, ask_user, on_event)
+                    print("  " + (when sr["last_status"] == "ok" then green("✓ ") otherwise red("✗ ")) + sr["last_status"] + " · " + first_line(sr["last_summary"], 160))
+                    print("  " + dim("log: " + schedule.LOG_DIR + "/" + st["id"] + ".log"))
+            otherwise when (sact == "on" or sact == "off") and sid_arg != ""
+                try
+                    print("  " + schedule.set_enabled(sid_arg, sact == "on"))
+                recover err
+                    print("  " + red(text(err)))
+            otherwise when sact == "remove" and sid_arg != ""
+                try
+                    print("  " + schedule.remove(sid_arg))
+                recover err
+                    print("  " + red(text(err)))
+            otherwise when sact == "log" and sid_arg != ""
+                let tl be schedule.log_tail(sid_arg, 60)
+                print(when tl == "" then "  sin corridas todavía" otherwise tl)
+            otherwise
+                let ss be schedule.summary()
+                let age be schedule.daemon_age()
+                when length(ss) == 0
+                    print("  sin tareas programadas. Pedísela al agente («cada 6 horas corré los tests y avisame») o: " + cyan("/schedule add <json>"))
+                each s in ss
+                    print("  " + (when s["running"] then yellow("● ") otherwise (when s["enabled"] then green("● ") otherwise dim("○ "))) + pad(s["id"], 22) + dim(pad(s["plan"], 30)) + s["action_text"])
+                    print("      " + dim("permisos " + s["permission"] + " · próxima " + s["next_local"] + (when s["last_run"] != nothing then " · última " + s["last_status"] + ": " + first_line(s["last_summary"], 80) otherwise "")))
+                let pend be approvals.pending()
+                each ap in pend
+                    print("  " + yellow("⚠ aprobación pendiente " + ap["id"] + ": " + first_line(ap["message"], 100)) + dim("  → /approve " + ap["id"] + " yes|no"))
+                print("  " + dim("corren solas mientras lampson esté abierto (tick cada " + text(schedule.TICK_SECONDS) + " s) · con todo cerrado: lampson --daemon start · run/on/off/remove/log <id>"))
+        otherwise when starts_with(input, "/approve ")
+            let atoks be where(split(trim(slice(input, 9, length(input))), " "), (x) => x != "")
+            when length(atoks) < 2 or not contains(["yes", "no", "si", "sí", "y", "n"], lower(atoks[1]))
+                print("  uso: /approve <id> yes|no   (pendientes: /schedule)")
+            otherwise
+                let yes be contains(["yes", "si", "sí", "y"], lower(atoks[1]))
+                when approvals.answer(atoks[0], yes)
+                    print("  " + (when yes then green("✓ permitido ") otherwise red("✗ denegado ")) + atoks[0])
+                otherwise
+                    print("  " + red("no hay una aprobación pendiente con id " + atoks[0]))
         otherwise when input == "/lamps" or starts_with(input, "/lamps ")
             let lrest be trim(slice(input, 6, length(input)))
             when starts_with(lrest, "run ")

package/cli.syn

@@ -0,0 +1,68 @@
+-- cli.syn — lo que los launchers (lampson.ps1 / lampson.sh) le piden a Synsema. Corre con cwd = instalación.
+--
+--   LAMPSON_CMD=ensure  LAMPSON_WORKSPACE=<ruta>  synsema run cli.syn
+--       registra/prepara el workspace, asegura el hub y su proceso → imprime UNA línea JSON {slug, port, dir, url, alive}
+--   LAMPSON_CMD=hub-status  → {alive}
+--   LAMPSON_CMD=hub-start | hub-stop
+--   LAMPSON_CMD=list
+-- La salida útil va en la ÚLTIMA línea (JSON) para que el launcher la parsee.
+
+require exec
+require time
+require net("127.0.0.1")
+require env("LAMPSON_*")
+require env("OS")
+require env("HOME")
+require env("USERPROFILE")
+require file(".lampson")
+require file(".lampson/*")
+require file.read("web.syn")
+require file.read(".env")
+require file.read("chat.syn")
+require file.read("hub.tpl.syn")
+require file("hub.syn")
+
+use "./lib/workspaces.syn" as ws
+
+let cmd be env("LAMPSON_CMD", "ensure")
+
+when cmd == "ensure"
+    let path be env("LAMPSON_WORKSPACE", "")
+    when path == ""
+        raise("LAMPSON_WORKSPACE required")
+    let w be ws.ensure(path)
+    when not ws.hub_alive()
+        ws.start_hub()
+    let hc be ws.health(w)
+    when hc == nothing
+        ws.start_ws(w)
+        ws.wait_ready(w, 10)
+        set hc to ws.health(w)
+    ws.touch(w["slug"])
+    print(json_encode({"slug": w["slug"], "port": w["port"], "dir": ws.dir_of(w["slug"]), "url": "http://127.0.0.1:" + text(ws.HUB_PORT) + "/w/" + w["slug"], "alive": hc != nothing, "hub": ws.hub_alive()}))
+otherwise when cmd == "hub-status"
+    print(json_encode({"alive": ws.hub_alive(), "workspaces": ws.summary()}))
+otherwise when cmd == "hub-start"
+    when not ws.hub_alive()
+        ws.start_hub()
+    print(json_encode({"alive": true}))
+otherwise when cmd == "hub-stop"
+    each w in ws.all()
+        ws.stop_ws(w)
+    ws.stop_hub()
+    print(json_encode({"alive": false}))
+otherwise when cmd == "hub-restart"
+    -- lanzado desacoplado por workspaces.restart_hub_later: espera a que el hub termine lo que estaba haciendo,
+    -- lo para y lo vuelve a arrancar con el hub.syn regenerado (bajo systemd, Restart=always ya lo levanta solo)
+    sleep(1.5)
+    ws.stop_hub()
+    sleep(2)
+    when not ws.hub_alive()
+        ws.start_hub()
+    print(json_encode({"restarted": true}))
+otherwise when cmd == "list"
+    each w in ws.summary()
+        print((when w["alive"] then "● " otherwise "○ ") + w["slug"] + "  " + w["path"] + "  :" + text(w["port"]) + "  " + w["policy"])
+    print(json_encode({"count": length(ws.all())}))
+otherwise
+    raise("unknown LAMPSON_CMD " + cmd)

package/hub.tpl.syn

@@ -0,0 +1,127 @@
+-- hub.tpl.syn — PLANTILLA del hub. lib/workspaces.syn genera hub.syn (gitignored) reemplazando `-- @workspaces` por una
+-- ruta proxy por workspace; el hub corre con `synsema daemon start hub.syn --watch` y se reinicia solo al cambiar.
+--
+-- El hub es lo único que escucha hacia afuera (:8080; en un VPS, con --domain/--tls-auto):
+--   GET  /                    pantalla de workspaces (public/hub.html)
+--   GET  /w/<slug>            la UI de ese workspace (public/index.html; los assets /css /js los sirve el hub)
+--   *    /w/<slug>/api/…      proxy al proceso del workspace (127.0.0.1:808N) — SSE y WebSocket pasan (Synsema ≥ 0.6.12)
+--   GET  /w/<slug>/approve/…  links de aprobación de ese workspace
+--   /api/workspaces…          registro, crear (diálogo nativo o explorador), start/stop/quitar, política
+-- Supervisor: cada 15 s arranca los workspaces que deben vivir y apaga los inactivos (política en ⚙ → idle_hours).
+-- Solo loopback puede usar la API del hub (misma regla que web.syn); LAMPSON_WEB_TOKEN para scripts remotos.
+
+intent: "Lampson hub: workspaces registry, supervisor and reverse proxy to one process per workspace"
+
+require serve(8080)
+require net("127.0.0.1")
+require time
+require exec
+require env("LAMPSON_*")
+require env("OS")
+require env("HOME")
+require env("USERPROFILE")
+require file(".lampson")
+require file(".lampson/*")
+require file.read("web.syn")
+require file.read(".env")
+require file.read("chat.syn")
+require file.read("hub.tpl.syn")
+require file("hub.syn")
+require file.read("public")
+require file.read("public/*")
+
+use "./lib/workspaces.syn" as ws
+use "./lib/settings.syn" as settings
+
+task check_client(token, request)
+    let ip be text(ip of request)
+    when ip == "127.0.0.1" or ip == "::1" or ip == "::ffff:127.0.0.1"
+        give {"local": true}
+    let want be env("LAMPSON_WEB_TOKEN", "")
+    when want != "" and token == want
+        give {"local": false}
+    give nothing
+
+task hub_tick()
+    give ws.tick()
+cron_every(15, hub_tick)
+
+serve on 8080
+    max_streams 200
+    auth with check_client
+    static "./public"
+
+    route "GET /"
+        give html(read_file("public/hub.html"))
+
+    -- la UI de un workspace: el mismo index.html; el frontend deduce /w/<slug> de la URL (BASE en js/core.js).
+    -- Sin barra final: el runtime normaliza "/w/x/" → "/w/x" (301), así que la ruta canónica es esta
+    route "GET /w/:slug"
+        give html(read_file("public/index.html"))
+
+    route "GET /api/hub" requires auth
+        give {"ok": true, "port": ws.HUB_PORT, "idle_hours": ws.idle_hours(), "home": ws.home()}
+
+    route "GET /api/workspaces" requires auth
+        give {"workspaces": ws.summary(), "idle_hours": ws.idle_hours()}
+
+    -- registrar una carpeta como workspace (y arrancarla)
+    route "POST /api/workspaces" requires auth
+        expect body {path: text}
+        let b be json of request
+        try
+            let w be ws.ensure(text(b["path"]))
+            ws.start_ws(w)
+            ws.wait_ready(w, 8)
+            give {"ok": true, "workspace": w, "url": "/w/" + w["slug"] + "/"}
+        recover err
+            give fail(400, text(err))
+
+    route "POST /api/workspaces/start" requires auth
+        expect body {slug: text}
+        let b be json of request
+        let w be ws.get(text(b["slug"]))
+        when w == nothing
+            give not_found("no such workspace")
+        ws.start_ws(w)
+        give {"ok": ws.wait_ready(w, 8)}
+
+    route "POST /api/workspaces/stop" requires auth
+        expect body {slug: text}
+        let b be json of request
+        let w be ws.get(text(b["slug"]))
+        when w == nothing
+            give not_found("no such workspace")
+        give {"ok": ws.stop_ws(w)}
+
+    route "POST /api/workspaces/remove" requires auth
+        expect body {slug: text}
+        let b be json of request
+        try
+            give {"ok": true, "result": ws.remove(text(b["slug"]))}
+        recover err
+            give fail(400, text(err))
+
+    -- política por workspace: auto | always | off
+    route "POST /api/workspaces/policy" requires auth
+        expect body {slug: text, policy: text}
+        let b be json of request
+        let w be ws.get(text(b["slug"]))
+        when w == nothing
+            give not_found("no such workspace")
+        when not contains(["auto", "always", "off"], text(b["policy"]))
+            give fail(400, "policy must be auto | always | off")
+        set w["policy"] to text(b["policy"])
+        ws.put(w)
+        give {"ok": true}
+
+    -- diálogo nativo del SO (PC); nothing → la UI usa el explorador propio
+    route "POST /api/workspaces/pick" requires auth
+        let p be ws.pick_folder()
+        give {"path": p, "native": p != nothing}
+
+    route "GET /api/workspaces/browse" requires auth
+        give ws.browse(when contains(query, "path") then text(query.path) otherwise "")
+
+    -- proxies generados (una por workspace registrado):
+    -- @workspaces