lampson 0.1.3 → 0.2.0

package/lampson.ps1

@@ -1,28 +1,29 @@
-# lampson.ps1 — launcher Windows. Monta el proyecto como ./workspace (junction) y arranca.
+# lampson.ps1 — launcher Windows. Cada proyecto es un WORKSPACE con su propio proceso; un hub en :8080 los sirve a todos.
 #
-#   cd C:\mi\proyecto ; lampson                 # el directorio ACTUAL es el workspace (REPL)
-#   cd C:\mi\proyecto ; lampson --web           # servidor web en http://127.0.0.1:8080  (también -Web)
-#   lampson --workspace C:\otro\proyecto        # elegir la ubicación explícitamente     (también -Workspace)
-#   lampson --agent plan                        # perfil inicial: build | plan | review | explore
-#   lampson --yolo | --strict | --ask            # permisos para comandos peligrosos (--dangerously-skip-permissions = --yolo)
-#   lampson --update                            # actualizar Lampson (git pull) y salir
-#   lampson --help
+#   cd C:\mi\proyecto ; lampson                 # terminal sobre este workspace (lo registra y lo arranca si hace falta)
+#   cd C:\mi\proyecto ; lampson --web           # abre http://127.0.0.1:8080/w/<slug>/ en el navegador
+#   lampson --workspace C:\otro\proyecto        # elegir la carpeta explícitamente
+#   lampson --hub start|stop|status|logs        # el servicio residente (workspaces + tareas programadas)
+#   lampson --install | --uninstall             # arrancar el hub al iniciar sesión (Tarea Programada)
+#   lampson --agent plan · --yolo|--strict|--ask · --update · --help
 #
-# Por qué una junction: el scope file("./*") de Synsema v0.6.7 equivale a "*" (disco entero); el scope
-# file("workspace/*") sí confina. Montar el proyecto bajo un nombre literal es lo que hace real el
-# least-privilege de las tools (mismo modelo mental que `docker -v proyecto:/workspace`).
+# Cómo funciona (ver SPEC-WORKSPACES.md): .lampson\ws\<slug>\ es el cwd del proceso del workspace, con una junction
+# `workspace` al proyecto y junctions a lib/public/skills/lamps/memory de esta instalación. El registro y los procesos
+# los maneja lib/workspaces.syn vía cli.syn; este script solo resuelve la carpeta, llama a cli.syn y abre lo pedido.
 $ErrorActionPreference = "Stop"
 $here = Split-Path -Parent $MyInvocation.MyCommand.Path
 $caller = (Get-Location).Path
-$mount = Join-Path $here "workspace"
 
 # --- args: acepta --flag y -Flag, sin distinguir mayúsculas ---
-$Workspace = ""; $Web = $false; $Agent = ""; $Perm = ""
+$Workspace = ""; $Web = $false; $Agent = ""; $Perm = ""; $Hub = ""; $Install = ""
 $i = 0
 while ($i -lt $args.Count) {
     $a = [string]$args[$i]
     switch -Regex ($a.ToLower()) {
         '^--?(web|w)$'          { $Web = $true }
+        '^--?(hub|daemon|d)$'   { $i++; $Hub = if ($i -lt $args.Count) { ([string]$args[$i]).ToLower() } else { "status" } }
+        '^--?install$'          { $Install = "install" }
+        '^--?uninstall$'        { $Install = "uninstall" }
         '^--?(workspace|ws)$'   { $i++; $Workspace = [string]$args[$i] }
         '^--?(agent|a)$'        { $i++; $Agent = [string]$args[$i] }
         '^--?(yolo|y|dangerously-skip-permissions)$' { $Perm = "yolo" }
@@ -30,59 +31,84 @@ while ($i -lt $args.Count) {
         '^--?(ask)$'            { $Perm = "ask" }
         '^--?(permission|p)$'   { $i++; $Perm = ([string]$args[$i]).ToLower() }
         '^--?(update|u)$'       { Write-Host "actualizando Lampson en $here"; git -C $here pull --ff-only origin main; Write-Host ("lampson " + (git -C $here rev-parse --short HEAD)); exit $LASTEXITCODE }
-        '^--?(help|h|\?)$'      { Get-Content $PSCommandPath | Select-Object -Skip 1 -First 9 | ForEach-Object { $_.TrimStart('#',' ') }; exit 0 }
+        '^--?(help|h|\?)$'      { Get-Content $PSCommandPath | Select-Object -Skip 1 -First 8 | ForEach-Object { $_.TrimStart('#',' ') }; exit 0 }
         default                 { if ($Workspace -eq "" -and -not $a.StartsWith("-")) { $Workspace = $a } else { Write-Error "argumento desconocido: $a (probá lampson --help)"; exit 1 } }
     }
     $i++
 }
 
-# --- resolver el proyecto: explícito > directorio actual (si no es el propio lampson) > montado previo ---
-if ($Workspace -eq "" -and $caller -ne $here) { $Workspace = $caller }
-if ($Workspace -ne "") {
-    if (-not (Test-Path -LiteralPath $Workspace -PathType Container)) { Write-Error "el workspace no existe o no es un directorio: $Workspace"; exit 1 }
-    $target = (Resolve-Path -LiteralPath $Workspace).Path
-    $home_ = [Environment]::GetFolderPath("UserProfile")
-    if ($target.TrimEnd('\') -eq $home_.TrimEnd('\') -or $target -match '^[A-Za-z]:\\?$') {
-        Write-Error "'$target' es tu carpeta personal / la raíz del disco, no un proyecto. Entrá al repo (cd) y volvé a correr lampson, o usá --workspace C:\ruta\al\proyecto"; exit 1
-    }
-    if ($target -eq $here) { Write-Error "no montes el propio directorio de lampson como workspace desde fuera; usá --workspace"; exit 1 }
-    if (Test-Path -LiteralPath $mount) {
-        $item = Get-Item -LiteralPath $mount -Force
-        if ($item.LinkType -ne "Junction") { Write-Error "./workspace existe y no es una junction; movelo antes de montar otro proyecto"; exit 1 }
-        $item.Delete()
-    }
-    New-Item -ItemType Junction -Path $mount -Target $target | Out-Null
-} elseif (-not (Test-Path -LiteralPath $mount)) {
-    Write-Error "no hay workspace: corré lampson desde el directorio del proyecto, o lampson --workspace C:\ruta"; exit 1
-}
-$target = (Get-Item -LiteralPath $mount -Force).Target
-if ($target -is [array]) { $target = $target[0] }
-
-# --- skills externas globales (npx skills add -g → ~/.agents/skills; las de Claude Code → ~/.claude/skills) ---
-# Se montan como junction bajo .lampson/ porque una capability no puede apuntar a una ruta dinámica (HOME).
+# skills externas globales (npx skills add -g → ~/.agents/skills; Claude Code → ~/.claude/skills), montadas bajo .lampson\
+# (una capability no puede apuntar a HOME); los workspaces las ven por su junction .lampson\global
 $skillMounts = @{ "skills-global" = (Join-Path $HOME ".agents\skills"); "skills-claude" = (Join-Path $HOME ".claude\skills") }
 New-Item -ItemType Directory -Force (Join-Path $here ".lampson") | Out-Null
 foreach ($k in $skillMounts.Keys) {
     $link = Join-Path $here ".lampson\$k"; $src = $skillMounts[$k]
-    if (Test-Path -LiteralPath $link) { $li = Get-Item -LiteralPath $link -Force; if ($li.LinkType -eq "Junction") { $li.Delete() } }
-    if (Test-Path -LiteralPath $src -PathType Container) { New-Item -ItemType Junction -Path $link -Target $src | Out-Null }
+    if (-not (Test-Path -LiteralPath $link) -and (Test-Path -LiteralPath $src -PathType Container)) { New-Item -ItemType Junction -Path $link -Target $src | Out-Null }
+}
+
+function Invoke-Cli([string]$cmd, [string]$ws) {
+    # cli.syn imprime la respuesta como la ÚLTIMA línea (JSON)
+    $env:LAMPSON_CMD = $cmd; if ($ws -ne "") { $env:LAMPSON_WORKSPACE = $ws }
+    $out = & synsema run cli.syn 2>&1
+    if ($LASTEXITCODE -ne 0) { $out | ForEach-Object { Write-Host $_ }; throw "cli.syn falló ($cmd)" }
+    $lines = @($out | ForEach-Object { [string]$_ })
+    $lines | Select-Object -SkipLast 1 | ForEach-Object { Write-Host $_ }
+    return ($lines[-1] | ConvertFrom-Json)
 }
 
-# --- arrancar desde el directorio de lampson (ahí viven .env, lib/, skills/, .lampson/) ---
-# Push/Pop: si PowerShell ejecuta este .ps1 en la shell del usuario (pasa cuando lampson.ps1 y lampson.cmd
-# comparten nombre en el PATH), el cwd del usuario debe quedar como estaba al salir.
 Push-Location $here
 try {
-    $env:LAMPSON_WORKSPACE = $target
-    if ($Agent -ne "") { $env:LAMPSON_AGENT = $Agent }
-    if ($Perm -ne "") { $env:LAMPSON_PERMISSION = $Perm }
+    $env:LAMPSON_HOME = $here
+    # --- hub / servicio ---
+    if ($Hub -ne "") {
+        switch ($Hub) {
+            "start"   { $r = Invoke-Cli "hub-start" ""; Write-Host "hub: http://127.0.0.1:8080" }
+            "stop"    { $r = Invoke-Cli "hub-stop" ""; Write-Host "hub y workspaces parados" }
+            "status"  { $r = Invoke-Cli "hub-status" ""; Write-Host ("hub " + $(if ($r.alive) { "● vivo · http://127.0.0.1:8080" } else { "○ parado" })); foreach ($w in $r.workspaces) { Write-Host ("  " + $(if ($w.alive) { "●" } else { "○" }) + " " + $w.name + "  " + $w.path + "  " + $w.policy) } }
+            "logs"    { if (Test-Path ".lampson\hub.log") { Get-Content ".lampson\hub.log" -Tail 40 } else { Write-Host "sin log todavía" } }
+            "restart" { $null = Invoke-Cli "hub-stop" ""; Start-Sleep 1; $null = Invoke-Cli "hub-start" ""; Write-Host "hub reiniciado" }
+            default   { Write-Error "uso: lampson --hub start|stop|status|logs|restart"; exit 1 }
+        }
+        exit 0
+    }
+    # --- arranque al iniciar sesión: Tarea Programada que corre el hub (synsema daemon, --watch) ---
+    if ($Install -eq "install") {
+        $cmd = "cmd /c cd /d `"$here`" && set LAMPSON_HOME=$here && synsema serve hub.syn > .lampson\hub.log 2>&1"
+        schtasks /Create /F /TN "Lampson hub" /SC ONLOGON /TR $cmd | Out-Null
+        Write-Host "instalado: el hub de Lampson arranca al iniciar sesión (Tarea Programada «Lampson hub»). Arrancándolo ahora…"
+        $null = Invoke-Cli "hub-start" ""
+        exit 0
+    }
+    if ($Install -eq "uninstall") { schtasks /Delete /F /TN "Lampson hub" | Out-Null; Write-Host "quitado el arranque al iniciar sesión (el hub sigue corriendo hasta lampson --hub stop)"; exit 0 }
+
+    # --- resolver el proyecto: explícito > directorio actual (si no es el propio lampson) ---
+    if ($Workspace -eq "" -and $caller -ne $here) { $Workspace = $caller }
+    if ($Workspace -eq "") { Write-Error "corré lampson desde la carpeta del proyecto, o lampson --workspace C:\ruta (lampson --hub status lista los workspaces)"; exit 1 }
+    if (-not (Test-Path -LiteralPath $Workspace -PathType Container)) { Write-Error "el workspace no existe o no es un directorio: $Workspace"; exit 1 }
+    $target = (Resolve-Path -LiteralPath $Workspace).Path
+    $home_ = [Environment]::GetFolderPath("UserProfile")
+    if ($target.TrimEnd('\') -eq $home_.TrimEnd('\') -or $target -match '^[A-Za-z]:\\?$') {
+        Write-Error "'$target' es tu carpeta personal / la raíz del disco, no un proyecto. Entrá al repo (cd) y volvé a correr lampson, o usá --workspace C:\ruta\al\proyecto"; exit 1
+    }
+    if ($target -eq $here) { Write-Error "no montes el propio directorio de lampson como workspace"; exit 1 }
+
+    # registrar/preparar el workspace y asegurar hub + proceso
+    $r = Invoke-Cli "ensure" $target
+    $wsDir = Join-Path $here ($r.dir -replace '/', '\')
     if ($Web) {
-        Write-Host "Lampson web · workspace: $target"
-        Write-Host "abrí http://127.0.0.1:8080   (Ctrl+C para parar)"
-        synsema serve web.syn
-    } else {
-        synsema run chat.syn
+        Write-Host ("Lampson web · " + $r.url + "   (workspace " + $r.slug + $(if ($r.alive) { " ● vivo" } else { " ○ arrancando" }) + ")")
+        Start-Process $r.url
+        exit 0
     }
+    # terminal: chat.syn dentro del directorio del workspace (misma junction `workspace` que el proceso web)
+    Push-Location $wsDir
+    try {
+        $env:LAMPSON_WORKSPACE = $target; $env:LAMPSON_WS = $r.slug; $env:LAMPSON_PORT = [string]$r.port
+        if ($Agent -ne "") { $env:LAMPSON_AGENT = $Agent }
+        if ($Perm -ne "") { $env:LAMPSON_PERMISSION = $Perm }
+        $envFile = Join-Path $here ".env"
+        if (Test-Path -LiteralPath $envFile) { synsema run --env-file $envFile chat.syn } else { synsema run chat.syn }
+    } finally { Pop-Location }
 } finally {
     Pop-Location
 }

package/lampson.sh

@@ -1,42 +1,88 @@
 #!/usr/bin/env bash
-# lampson.sh — launcher unix. El directorio ACTUAL es el workspace (o --workspace /ruta).
-#   cd /mi/proyecto && lampson            # REPL   (con lampson/ en el PATH)
-#   cd /mi/proyecto && lampson --web      # servidor web en http://127.0.0.1:8080
-#   lampson --workspace /otro/proyecto [--web] [--agent plan]
+# lampson.sh — launcher unix. Cada proyecto es un WORKSPACE con su propio proceso; un hub en :8080 los sirve a todos.
+#   cd /mi/proyecto && lampson            # terminal sobre este workspace
+#   cd /mi/proyecto && lampson --web      # abre http://127.0.0.1:8080/w/<slug>/
+#   lampson --hub start|stop|status|logs|restart · --install (systemd --user) · --uninstall
+#   lampson --workspace /ruta [--agent plan] [--yolo|--strict|--ask] · --update
 set -euo pipefail
 here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 caller="$(pwd)"
-ws=""; web=0
+ws=""; web=0; hub=""; install=""
 while [ $# -gt 0 ]; do
     case "$1" in
         --web) web=1 ;;
+        --hub|--daemon) shift; hub="${1:-status}" ;;
+        --install) install=install ;;
+        --uninstall) install=uninstall ;;
         --workspace) shift; ws="$1" ;;
         --agent) shift; export LAMPSON_AGENT="$1" ;;
         --yolo|--dangerously-skip-permissions) export LAMPSON_PERMISSION=yolo ;;
         --strict) export LAMPSON_PERMISSION=strict ;;
         --ask) export LAMPSON_PERMISSION=ask ;;
         --update) echo "actualizando Lampson en $here"; git -C "$here" pull --ff-only origin main; echo "lampson $(git -C "$here" rev-parse --short HEAD)"; exit $? ;;
-        *) echo "uso: lampson [--web] [--workspace RUTA] [--agent PERFIL] [--yolo|--strict|--ask] [--update]" >&2; exit 1 ;;
+        -*) echo "uso: lampson [--web] [--hub start|stop|status|logs|restart] [--install|--uninstall] [--workspace RUTA] [--agent PERFIL] [--yolo|--strict|--ask] [--update]" >&2; exit 1 ;;
+        *) ws="$1" ;;
     esac
     shift
 done
-[ -z "$ws" ] && [ "$caller" != "$here" ] && ws="$caller"
-if [ -n "$ws" ]; then
-    [ -d "$ws" ] || { echo "el workspace no existe o no es un directorio: $ws" >&2; exit 1; }
-    ws="$(cd "$ws" && pwd)"
-    if [ -e "$here/workspace" ] && [ ! -L "$here/workspace" ]; then echo "./workspace existe y no es un symlink" >&2; exit 1; fi
-    rm -f "$here/workspace"; ln -s "$ws" "$here/workspace"
-elif [ ! -e "$here/workspace" ]; then
-    echo "no hay workspace: corré lampson desde el directorio del proyecto, o --workspace /ruta" >&2; exit 1
-fi
-export LAMPSON_WORKSPACE="$(readlink -f "$here/workspace")"
-# skills externas globales (npx skills add -g → ~/.agents/skills; Claude Code → ~/.claude/skills), montadas bajo .lampson/
+export LAMPSON_HOME="$here"
+# skills externas globales, montadas bajo .lampson/ (los workspaces las ven por .lampson/global)
 mkdir -p "$here/.lampson"
 for pair in "skills-global:$HOME/.agents/skills" "skills-claude:$HOME/.claude/skills"; do
     link="$here/.lampson/${pair%%:*}"; src="${pair#*:}"
-    [ -L "$link" ] && rm -f "$link"
-    [ -d "$src" ] && ln -s "$src" "$link"
+    [ -e "$link" ] || { [ -d "$src" ] && ln -s "$src" "$link"; } || true
 done
-echo "workspace -> $LAMPSON_WORKSPACE"
-cd "$here"
-if [ "$web" = 1 ]; then echo "web: http://127.0.0.1:8080"; exec synsema serve web.syn; else exec synsema run chat.syn; fi
+cli() { # última línea = JSON
+    local out; out="$(cd "$here" && LAMPSON_CMD="$1" LAMPSON_WORKSPACE="${2:-}" synsema run cli.syn)" || { echo "$out" >&2; exit 1; }
+    echo "$out" | sed '$d' >&2 || true
+    echo "$out" | tail -n 1
+}
+json() { node -e "const j=JSON.parse(process.argv[1]);const v=j[process.argv[2]];console.log(typeof v==='object'?JSON.stringify(v):v)" "$1" "$2" 2>/dev/null || python3 -c "import json,sys;print(json.loads(sys.argv[1])[sys.argv[2]])" "$1" "$2"; }
+if [ -n "$hub" ]; then
+    case "$hub" in
+        start) cli hub-start >/dev/null; echo "hub: http://127.0.0.1:8080" ;;
+        stop) cli hub-stop >/dev/null; echo "hub y workspaces parados" ;;
+        status) r="$(cli hub-status)"; echo "hub $( [ "$(json "$r" alive)" = "true" ] && echo '● vivo · http://127.0.0.1:8080' || echo '○ parado')"; (cd "$here" && LAMPSON_CMD=list synsema run cli.syn | sed '$d') ;;
+        logs) [ -f "$here/.lampson/hub.log" ] && tail -n 40 "$here/.lampson/hub.log" || echo "sin log todavía" ;;
+        restart) cli hub-stop >/dev/null; sleep 1; cli hub-start >/dev/null; echo "hub reiniciado" ;;
+        *) echo "uso: lampson --hub start|stop|status|logs|restart" >&2; exit 1 ;;
+    esac
+    exit 0
+fi
+if [ "$install" = install ]; then
+    unit="$HOME/.config/systemd/user/lampson-hub.service"; mkdir -p "$(dirname "$unit")"
+    cat > "$unit" <<EOF
+[Unit]
+Description=Lampson hub (workspaces, tareas programadas, proxy)
+After=network.target
+[Service]
+WorkingDirectory=$here
+Environment=LAMPSON_HOME=$here
+ExecStart=$(command -v synsema) serve hub.syn
+Restart=always
+RestartSec=3
+TimeoutStopSec=20
+[Install]
+WantedBy=default.target
+EOF
+    (cd "$here" && LAMPSON_CMD=hub-stop synsema run cli.syn >/dev/null 2>&1 || true)
+    systemctl --user daemon-reload && systemctl --user enable --now lampson-hub.service && echo "instalado: systemd --user lampson-hub.service (arranca con tu sesión; 'loginctl enable-linger $USER' para que viva sin sesión abierta)"
+    exit 0
+fi
+if [ "$install" = uninstall ]; then systemctl --user disable --now lampson-hub.service || true; rm -f "$HOME/.config/systemd/user/lampson-hub.service"; systemctl --user daemon-reload; echo "quitado"; exit 0; fi
+# --- proyecto ---
+[ -z "$ws" ] && [ "$caller" != "$here" ] && ws="$caller"
+[ -n "$ws" ] || { echo "corré lampson desde la carpeta del proyecto, o --workspace /ruta (lampson --hub status lista los workspaces)" >&2; exit 1; }
+[ -d "$ws" ] || { echo "el workspace no existe o no es un directorio: $ws" >&2; exit 1; }
+ws="$(cd "$ws" && pwd -P)"
+[ "$ws" = "$HOME" ] || [ "$ws" = "/" ] && { echo "'$ws' no es un proyecto" >&2; exit 1; }
+r="$(cli ensure "$ws")"
+slug="$(json "$r" slug)"; port="$(json "$r" port)"; url="$(json "$r" url)"; dir="$(json "$r" dir)"
+if [ "$web" = 1 ]; then
+    echo "Lampson web · $url   (workspace $slug)"
+    (xdg-open "$url" >/dev/null 2>&1 || open "$url" >/dev/null 2>&1 || true)
+    exit 0
+fi
+cd "$here/$dir"
+export LAMPSON_WORKSPACE="$ws" LAMPSON_WS="$slug" LAMPSON_PORT="$port"
+if [ -f "$here/.env" ]; then exec synsema run --env-file "$here/.env" chat.syn; else exec synsema run chat.syn; fi

package/lib/agents.syn

@@ -40,7 +40,7 @@ let PARALLEL be 4
 
 export let PROFILES be {
     "build": {
-        "tools": ["read", "write", "edit", "ls", "find", "grep", "lsp", "bash", "process", "memory", "todo", "skill", "mcp", "lamp", "delegate"],
+        "tools": ["read", "write", "edit", "ls", "find", "grep", "lsp", "bash", "process", "memory", "todo", "skill", "mcp", "lamp", "schedule", "delegate"],
         "steps": 40,
         "addendum": "You are in BUILD mode: you may read, edit, create files and run commands. Delegate exploration of large codebases to the `explore` agent and independent code review to the `review` agent when it saves context; several independent questions can go in one delegate call (they run in parallel)."
     },

package/lib/approvals.syn

@@ -0,0 +1,179 @@
+-- lib/approvals.syn — aprobaciones humanas fuera de la terminal: cola compartida + webhook + links de decisión
+--
+-- Un solo mecanismo para las puertas por las que un humano aprueba algo que el agente quiere hacer:
+--   1. la UI web (POST /api/approve desde el chat, o desde el panel «Aprobaciones» para las tareas programadas);
+--   2. la terminal: /approve <id> yes|no (una tarea programada corriendo en background mientras chateás);
+--   3. un LINK firmado que llega por el canal que sea (Telegram, mail, Slack…): GET /approve/<id>/<token>?d=yes|no
+--      — de un solo uso; el token es un secreto por aprobación (32 bytes CSPRNG), igual que el `approve` nativo
+--      de Synsema bajo serve (doc 62-human), solo que acá también sirve para las tareas del cron y para la UI;
+--   4. la consola del proceso (el link se imprime ahí también).
+-- Además, si LAMPSON_WEBHOOK_URL está configurado (o config.json {"webhook_url"}), cada aprobación pendiente dispara
+-- un POST JSON con {id, message, why, expires_at, respond_link_yes, respond_link_no} firmado con HMAC-SHA256
+-- (X-Lampson-Signature: sha256=<hex>, secreto LAMPSON_WEBHOOK_SECRET) — el mismo patrón que Stripe/GitHub, así
+-- cualquier receptor (n8n, un bot, otro .syn) reenvía los links. Los links necesitan LAMPSON_PUBLIC_URL (la URL
+-- por la que se llega a este lampson desde afuera: un túnel, el VPS, un edge Synsema con TLS).
+-- Fire-and-forget (10 s, un intento): un canal caído nunca bloquea; la UI y la consola quedan como respaldo.
+--
+-- Estado: BLACKBOARD (share/observe), que existe bajo `serve` y bajo `run` y lo ven handlers, agentes y ticks
+-- (`state_*` solo existe bajo serve — verificado 2026-08-29). Claves: "approval:meta:<id>" (visible, sin token),
+-- "approval:token:<id>", "approval:answer:<id>" (yes|no) y el índice "approval:index" (lista de ids).
+--
+-- Garantía: NUNCA se auto-aprueba. Sin respuesta al vencer el plazo → denegado (fail-closed), como Synsema.
+
+use "./settings.syn" as settings
+
+task read_cfg(key, envname)
+    let v be env(envname, "")
+    when v != ""
+        give v
+    let doc be settings.load()
+    when contains(doc, key)
+        give text(doc[key])
+    give ""
+
+export task webhook_url()
+    require env("LAMPSON_*")
+    require file.read(".lampson")
+    require file.read(".lampson/*")
+    give read_cfg("webhook_url", "LAMPSON_WEBHOOK_URL")
+
+export task public_url()
+    require env("LAMPSON_*")
+    require file.read(".lampson")
+    require file.read(".lampson/*")
+    let u be read_cfg("public_url", "LAMPSON_PUBLIC_URL")
+    while length(u) > 0 and slice(u, length(u) - 1, length(u)) == "/"
+        set u to slice(u, 0, length(u) - 1)
+    give u
+
+task secret_text()
+    give read_cfg("webhook_secret", "LAMPSON_WEBHOOK_SECRET")
+
+task index()
+    observe "approval:index" as ix
+    give when ix == nothing then [] otherwise ix
+
+task meta_of(id)
+    observe "approval:meta:" + id as m
+    give m
+
+task set_meta(id, m)
+    share m as "approval:meta:" + id
+
+-- abre una aprobación: id único, token de un solo uso, metadatos visibles (sin token) para la UI.
+-- source = "chat" | "schedule:<id>"; message = lo que se quiere hacer; why = por qué pide permiso.
+export task open(source, message, why, timeout_s)
+    require time
+    require random
+    require net
+    require env("LAMPSON_*")
+    require file.read(".lampson")
+    require file.read(".lampson/*")
+    let id be "a" + slice(text(floor(now() * 1000)), 4, 13) + "-" + slice(token(16), 0, 6)
+    let tok be token(32)
+    let meta be {"id": id, "source": source, "message": message, "why": why, "created": now(), "expires_at": floor(now() + timeout_s), "status": "pending"}
+    set_meta(id, meta)
+    share tok as "approval:token:" + id
+    share nothing as "approval:answer:" + id
+    share append(index(), id) as "approval:index"
+    bus_publish("approval.request", meta)
+    let links be links_for(id, tok)
+    print("[lampson] aprobación pendiente " + id + " — " + message + " (vence en " + text(floor(timeout_s)) + " s)" + (when links["yes"] != "" then "\n  sí: " + links["yes"] + "\n  no: " + links["no"] otherwise "\n  respondé desde la UI web (Aprobaciones), con /approve " + id + " yes|no en la terminal, o configurá la URL pública para recibir links"))
+    notify(meta, links)
+    give id
+
+-- bajo el hub cada workspace vive en /w/<slug> (LAMPSON_WS); el link público lleva ese prefijo
+task links_for(id, tok)
+    let slug be env("LAMPSON_WS", "")
+    let prefix be when slug == "" then "" otherwise "/w/" + slug
+    let base be public_url()
+    when base == ""
+        give {"yes": "", "no": "", "path": prefix + "/approve/" + id + "/" + tok}
+    give {"yes": base + prefix + "/approve/" + id + "/" + tok + "?d=yes", "no": base + prefix + "/approve/" + id + "/" + tok + "?d=no", "path": prefix + "/approve/" + id + "/" + tok}
+
+-- webhook firmado (fire-and-forget)
+task notify(meta, links)
+    let url be webhook_url()
+    when url == ""
+        give false
+    let payload be {"id": meta["id"], "type": "approve", "source": meta["source"], "message": meta["message"], "why": meta["why"], "expires_at": meta["expires_at"], "respond_path": links["path"], "respond_link_yes": links["yes"], "respond_link_no": links["no"]}
+    let body be json_encode(payload)
+    let headers be {"Content-Type": "application/json", "User-Agent": "lampson"}
+    let sec be secret_text()
+    when sec != ""
+        set headers["X-Lampson-Signature"] to "sha256=" + hmac_sha256(body, sec)
+    try
+        let r be http_post(url, body, headers)
+        when not r["ok"]
+            print("[lampson] webhook " + url + " respondió " + text(r["status"]))
+        give r["ok"]
+    recover err
+        print("[lampson] webhook falló: " + text(err))
+        give false
+
+-- espera (polling) hasta que alguien responda o venza el plazo. Devuelve true/false; sin respuesta = false.
+export task wait(id, timeout_s)
+    require time
+    let deadline be now() + timeout_s
+    let answer be nothing
+    while answer == nothing and now() < deadline
+        observe "approval:answer:" + id as a
+        set answer to a
+        when answer == nothing
+            sleep(0.5)
+    let meta be meta_of(id)
+    let ok be answer == "yes"
+    when meta != nothing
+        set meta["status"] to when answer == nothing then "expired" otherwise (when ok then "approved" otherwise "denied")
+        set meta["answered"] to now()
+        set_meta(id, meta)
+        bus_publish("approval.result", meta)
+    share nothing as "approval:token:" + id
+    give ok
+
+-- responder desde la UI (loopback, ya autenticado) o desde la terminal: sin token
+export task answer(id, decision)
+    let meta be meta_of(id)
+    when meta == nothing
+        give false
+    when meta["status"] != "pending"
+        give false
+    let v be when decision then "yes" otherwise "no"
+    share v as "approval:answer:" + id
+    give true
+
+-- responder por link: el token debe coincidir (comparación en tiempo constante) y ser de un solo uso
+export task answer_with_token(id, tok, decision)
+    observe "approval:token:" + id as want
+    when want == nothing
+        give {"ok": false, "why": "expired"}
+    when not verify_hmac(id, hmac_sha256(id, tok), want)
+        give {"ok": false, "why": "bad token"}
+    share nothing as "approval:token:" + id
+    let v be when decision then "yes" otherwise "no"
+    share v as "approval:answer:" + id
+    give {"ok": true, "why": ""}
+
+-- pendientes y recientes para la UI (nunca incluye tokens); las resueltas hace más de 1 h se olvidan
+export task list()
+    require time
+    let out be []
+    let keep be []
+    each id in index()
+        let m be meta_of(id)
+        when m != nothing
+            when m["status"] != "pending" and contains(m, "answered") and now() - m["answered"] > 3600
+                share nothing as "approval:meta:" + id
+            otherwise
+                set out to append(out, m)
+                set keep to append(keep, id)
+    when length(keep) != length(index())
+        share keep as "approval:index"
+    give sort_by(out, (m) => 0 - m["created"])
+
+export task pending()
+    give where(list(), (m) => m["status"] == "pending")
+
+-- página mínima que ve quien abre el link
+export task html_page(title, body)
+    give "<!doctype html><meta charset=utf-8><meta name=viewport content='width=device-width,initial-scale=1'><title>" + title + "</title><body style='font:16px/1.5 system-ui;margin:0;display:grid;place-items:center;min-height:100vh;background:#f6f4ef;color:#1d1c1a'><div style='max-width:520px;padding:32px;border:1px solid #d9d4c7;border-radius:6px;background:#fffdf8'><p style='margin:0 0 6px;font:11px/1 ui-monospace,monospace;letter-spacing:.12em;text-transform:uppercase;color:#a33'>lampson</p><h1 style='font-size:22px;margin:0 0 12px'>" + title + "</h1><p style='margin:0'>" + body + "</p></div></body>"

package/lib/lsp.syn

@@ -22,7 +22,16 @@
 
 use "./tools/common.syn" as c
 
-export let GLOBAL_CONFIG be ".lampson/lsp.json"
+-- global = compartido por todos los workspaces: .lampson/global/ (junction al .lampson de la instalación) cuando
+-- el proceso corre bajo el hub; .lampson/ en una instalación directa o en los tests
+task global_config()
+    try
+        when file_exists(".lampson/global")
+            give ".lampson/global/lsp.json"
+    recover err
+        give ".lampson/lsp.json"
+    give ".lampson/lsp.json"
+export let GLOBAL_CONFIG be global_config()
 export let PROJECT_CONFIG be "workspace/.lampson/lsp.json"
 let CALL_TIMEOUT be 60
 let START_WAIT be 25

package/lib/mcp.syn

@@ -23,7 +23,16 @@
 
 use "./tools/common.syn" as c
 
-export let GLOBAL_CONFIG be ".lampson/mcp.json"
+-- global = compartido por todos los workspaces: .lampson/global/ (junction al .lampson de la instalación) cuando
+-- el proceso corre bajo el hub; .lampson/ en una instalación directa o en los tests
+task global_config()
+    try
+        when file_exists(".lampson/global")
+            give ".lampson/global/mcp.json"
+    recover err
+        give ".lampson/mcp.json"
+    give ".lampson/mcp.json"
+export let GLOBAL_CONFIG be global_config()
 export let PROJECT_CONFIG be "workspace/.lampson/mcp.json"
 let CALL_TIMEOUT be 120
 

package/lib/permission.syn

@@ -114,6 +114,17 @@ export task evaluate(name, args, mode)
                 give {"decision": "deny", "reason": "strict mode (" + act + " MCP server)"}
             give {"decision": "ask", "reason": act + "s MCP server '" + (when contains(args, "name") then text(args["name"]) otherwise "?") + "'" + (when act == "add" then " → runs: " + (when contains(args, "command") then text(args["command"]) otherwise "?") otherwise "")}
         give {"decision": "allow", "reason": "read-only tool"}
+    when name == "schedule"
+        -- programar = autorizar corridas futuras SIN nadie mirando (un comando, una lámpara, o el agente entero
+        -- con un sobre de permisos): humano siempre, incluso en yolo. list/log son lectura.
+        let sact be when contains(args, "action") then text(args["action"]) otherwise "list"
+        when sact == "list" or sact == "log"
+            give {"decision": "allow", "reason": "read-only tool"}
+        when mode == "strict"
+            give {"decision": "deny", "reason": "strict mode (schedule " + sact + ")"}
+        when sact == "add"
+            give {"decision": "ask", "reason": "schedules an unattended " + (when contains(args, "kind") then text(args["kind"]) otherwise "?") + " task" + (when contains(args, "permission") then " with permission=" + text(args["permission"]) otherwise " with permission=ask")}
+        give {"decision": "ask", "reason": "schedule " + sact + " " + (when contains(args, "id") then text(args["id"]) otherwise "?")}
     when name == "skill" and is_install(args)
         -- instala instrucciones/scripts de terceros FUERA del workspace (~/.agents/skills): humano siempre, incluso en yolo
         when mode == "strict"
@@ -145,6 +156,13 @@ export task describe_call(name, args)
         when act == "remove"
             give "mcp remove " + (when contains(args, "name") then text(args["name"]) otherwise "?")
         give "mcp list"
+    when name == "schedule"
+        let sact be arg(args, "action", "list")
+        when sact == "add"
+            let what be arg(args, "kind", "?")
+            let body be when what == "lamp" then "lamp " + arg(args, "lamp", "?") + "." + arg(args, "tool", "?") + (when contains(args, "args") then " " + one_line(json_encode(args["args"]), 80) otherwise "") otherwise (when what == "bash" then "$ " + one_line(arg(args, "command", "?"), 120) otherwise "agent " + arg(args, "agent", "build") + ": " + one_line(arg(args, "prompt", "?"), 160))
+            give "schedule add «" + arg(args, "name", "?") + "» · " + arg(args, "at", "?") + " · " + body + " · permission " + arg(args, "permission", "ask") + (when contains(args, "notify") then " · notify " + text(args["notify"]) otherwise "")
+        give "schedule " + sact + (when contains(args, "id") then " " + text(args["id"]) otherwise "")
     when name == "skill" and is_install(args)
         give "skill install " + text(args["source"]) + " --skill " + text(args["name"]) + " (" + (when contains(args, "scope") then text(args["scope"]) otherwise "global") + ")"
     when name == "bash"