lampson 0.2.6 → 0.2.8

package/lib/loop.syn

@@ -23,7 +23,7 @@
 use "./provider.syn" as provider
 use "./permission.syn" as permission
 use "./mcp.syn" as mcp
-use "./lamps.syn" as lamps
+use "./plugins.syn" as plugins
 use "./tools/todo.syn" as todo
 
 let MAX_ERRORS_PER_TURN be 8
@@ -47,7 +47,7 @@ let REPEAT_HARD be 8
 -- seguidas sin ninguna acción (edit/write/bash/process/delegate/mcp). Visto 2026-08-28 con deepseek-v4-pro:
 -- 39 read/ls/find seguidos, 0 ediciones, 419k tokens, dos veces, con las reglas de prompt ignoradas.
 -- A la mitad del tope el resultado lleva un aviso; al tope, read/ls/find/grep se rechazan hasta que actúe.
-let READ_ONLY_TOOLS be ["read", "ls", "find", "grep"]
+let READ_ONLY_TOOLS be ["read", "ls", "find", "grep", "fetch"]
 let ACTION_TOOLS be ["edit", "write", "bash", "process", "delegate"]
 
 export task explore_cap()
@@ -67,7 +67,7 @@ export task explore_verdict(streak, name, cap)
     when n >= cap
         give {"streak": n, "note": "", "refuse": true}
     when n == floor(cap / 2)
-        give {"streak": n, "note": "\n\n[harness] " + text(n) + " read-only calls in a row without changing anything. You likely know enough: edit/write now, or run the relevant command. After " + text(cap) + " read-only calls in a row, read/ls/find/grep are refused until you act. If the codebase is genuinely too big, delegate ONE focused question to an `explore` sub-agent instead of reading everything yourself.", "refuse": false}
+        give {"streak": n, "note": "\n\n[harness] " + text(n) + " read-only calls in a row without changing anything. You likely know enough: edit/write now, or run the relevant command. After " + text(cap) + " read-only calls in a row, read/ls/find/grep/fetch are refused until you act. If the codebase is genuinely too big, delegate ONE focused question to an `explore` sub-agent instead of reading everything yourself.", "refuse": false}
     give {"streak": n, "note": "", "refuse": false}
 
 -- JSON canónico (claves ordenadas en profundidad): reordenar propiedades no engaña al detector
@@ -98,7 +98,8 @@ task safe_id(id, step)
 export task spill(name, id, out)
     require file(".lampson")
     require file(".lampson/*")
-    when name == "read" or length(out) <= SPILL_CAP
+    -- read y fetch se recortan solas (fetch: cabeza+cola con el texto completo ya en .lampson/spill)
+    when name == "read" or name == "fetch" or length(out) <= SPILL_CAP
         give out
     -- el informe de los subagentes es el entregable: no se manda a disco (hasta 60k)
     when name == "delegate" and length(out) <= SPILL_CAP * 6
@@ -285,9 +286,9 @@ task execute(tc, opts, on_event)
         -- tools MCP: no son tasks Synsema (args libres); el registry las marca con "mcp"
         when registry[name] == "mcp"
             set out to text(mcp.call(name, args))
-        -- tools de lámparas: un proceso hijo por llamada (lib/lamps.syn)
-        otherwise when registry[name] == "lamp"
-            set out to text(lamps.call(name, args))
+        -- tools de plugins: un proceso hijo por llamada (lib/plugins.syn)
+        otherwise when registry[name] == "plugin"
+            set out to text(plugins.call(name, args))
         otherwise
             set out to text(call_tool(registry[name], args))
     recover err
@@ -394,7 +395,7 @@ export task run_turn(cfg, messages, opts, on_event)
                 set out to "ERROR: you already called " + tc["name"] + " with these exact arguments " + text(repeats) + " times in a row. The result will not change; try a different approach or report the problem."
                 emit(on_event, "tool_denied", {"call": tc, "reason": "repeated call (" + text(repeats) + "x)"}, tag)
             otherwise when ex["refuse"]
-                set out to "ERROR: exploration cap reached — " + text(explore_streak) + " read-only calls in a row (read/ls/find/grep) without a single change. Reading more will not help. Do one of: (1) edit/write the files you already read; (2) run a command (bash/process) that moves the task; (3) delegate ONE focused question to an `explore` sub-agent; (4) tell the user what you need. read/ls/find/grep are refused until you do."
+                set out to "ERROR: exploration cap reached — " + text(explore_streak) + " read-only calls in a row (read/ls/find/grep) without a single change. Reading more will not help. Do one of: (1) edit/write the files you already read; (2) run a command (bash/process) that moves the task; (3) delegate ONE focused question to an `explore` sub-agent; (4) tell the user what you need. read/ls/find/grep/fetch are refused until you do."
                 emit(on_event, "tool_denied", {"call": tc, "reason": "exploration cap (" + text(explore_streak) + " read-only calls without acting)"}, tag)
             otherwise when contains(READ_ONLY_TOOLS, tc["name"]) and reads_total >= turn_cap
                 set out to "ERROR: this turn already made " + text(reads_total) + " read-only calls (limit " + text(turn_cap) + "). Everything you read is in your context. Act on it now (edit/write/run), delegate ONE focused question to an `explore` sub-agent, or report to the user."

package/lib/permission.syn

@@ -9,6 +9,8 @@
 --
 -- Modos (LAMPSON_PERMISSION): "ask" (default) | "yolo" (dangerous → allow) | "strict" (dangerous → deny)
 
+use "./tools/url.syn" as u
+
 -- Tier 1: nunca. Coincidencia por substring, case-insensitive.
 -- (el comando se evalúa con un espacio final añadido, así "rm -rf / " matchea la raíz pero NO "rm -rf /tmp/x")
 export let HARDLINE be [
@@ -69,6 +71,27 @@ export task evaluate(name, args, mode)
                 give {"decision": "deny", "reason": "strict mode (dangerous: " + danger + ")"}
             give {"decision": "ask", "reason": "dangerous pattern: " + danger}
         give {"decision": "allow", "reason": "command"}
+    when name == "fetch"
+        -- política de hosts de url.syn (hermes url_safety): secretos en la URL y metadata de la nube se
+        -- deniegan SIEMPRE (incluso en yolo); hosts privados/loopback (el dev server del usuario) piden;
+        -- lo público se permite. Una URL inválida se permite: la tool devuelve el error explicado.
+        let furl be when contains(args, "url") then text(args["url"]) otherwise ""
+        let why be u.sensitive(furl)
+        when why != nothing
+            give {"decision": "deny", "reason": "the URL carries " + why + " — secrets never travel in URLs"}
+        let fp be u.parse(furl)
+        when not fp["ok"]
+            give {"decision": "allow", "reason": "invalid URL (the tool explains)"}
+        let cls be u.host_class(fp["host"])
+        when cls == "blocked"
+            give {"decision": "deny", "reason": "cloud metadata endpoint " + fp["host"]}
+        when cls == "private"
+            when mode == "yolo"
+                give {"decision": "allow", "reason": "yolo mode (private host " + fp["host"] + ")"}
+            when mode == "strict"
+                give {"decision": "deny", "reason": "strict mode (private host " + fp["host"] + ")"}
+            give {"decision": "ask", "reason": "fetches a private/loopback host (" + fp["origin"] + ")"}
+        give {"decision": "allow", "reason": "public URL"}
     when name == "write" or name == "edit"
         -- el scope file("./*") ya impide salir del workspace; aquí solo miramos secretos obvios
         let p be when contains(args, "path") then lower(replace_text(text(args["path"]), "\\", "/")) otherwise ""
@@ -91,20 +114,20 @@ export task evaluate(name, args, mode)
         when mode == "strict"
             give {"decision": "deny", "reason": "strict mode (adds an LSP server)"}
         give {"decision": "ask", "reason": "configures LSP server '" + (when contains(args, "server") then text(args["server"]) otherwise "?") + "' (" + (when contains(args, "scope") then text(args["scope"]) otherwise "global") + ") — it will run the preset command on the first query"}
-    when starts_with(name, "lamp_")
-        -- tool de una lámpara (código del usuario/agente, un proceso por llamada): como las MCP
+    when starts_with(name, "plugin_")
+        -- tool de un plugin (código del usuario/agente, un proceso por llamada): como las MCP
         when mode == "yolo"
-            give {"decision": "allow", "reason": "yolo mode (lamp tool)"}
+            give {"decision": "allow", "reason": "yolo mode (plugin tool)"}
         when mode == "strict"
-            give {"decision": "deny", "reason": "strict mode (lamp tool)"}
-        give {"decision": "ask", "reason": "lamp tool " + name}
-    when name == "lamp"
-        -- encender una lámpara = autorizar código a correr con las capacidades de su manifiesto: humano SIEMPRE
+            give {"decision": "deny", "reason": "strict mode (plugin tool)"}
+        give {"decision": "ask", "reason": "plugin tool " + name}
+    when name == "plugin"
+        -- encender un plugin = autorizar código a correr con las capacidades de su manifiesto: humano SIEMPRE
         let act be when contains(args, "action") then text(args["action"]) otherwise "list"
         when act == "enable" or act == "disable"
             when mode == "strict"
-                give {"decision": "deny", "reason": "strict mode (" + act + " lamp)"}
-            give {"decision": "ask", "reason": act + "s lamp '" + (when contains(args, "name") then text(args["name"]) otherwise "?") + "'"}
+                give {"decision": "deny", "reason": "strict mode (" + act + " plugin)"}
+            give {"decision": "ask", "reason": act + "s plugin '" + (when contains(args, "name") then text(args["name"]) otherwise "?") + "'"}
         give {"decision": "allow", "reason": "read-only tool"}
     when name == "mcp"
         -- conectar un server MCP = ejecutar un comando de terceros con env propio: humano siempre, incluso en yolo
@@ -115,7 +138,7 @@ export task evaluate(name, args, mode)
             give {"decision": "ask", "reason": act + "s MCP server '" + (when contains(args, "name") then text(args["name"]) otherwise "?") + "'" + (when act == "add" then " → runs: " + (when contains(args, "command") then text(args["command"]) otherwise "?") otherwise "")}
         give {"decision": "allow", "reason": "read-only tool"}
     when name == "schedule"
-        -- programar = autorizar corridas futuras SIN nadie mirando (un comando, una lámpara, o el agente entero
+        -- programar = autorizar corridas futuras SIN nadie mirando (un comando, un plugin, o el agente entero
         -- con un sobre de permisos): humano siempre, incluso en yolo. list/log son lectura.
         let sact be when contains(args, "action") then text(args["action"]) otherwise "list"
         when sact == "list" or sact == "log"
@@ -140,15 +163,15 @@ task one_line(s, max)
     give t
 
 export task describe_call(name, args)
-    when starts_with(name, "mcp_") or starts_with(name, "lamp_")
+    when starts_with(name, "mcp_") or starts_with(name, "plugin_")
         give name + " " + one_line(json_encode(args), 160)
     when name == "lsp" and contains(args, "op") and text(args["op"]) == "add"
         give "lsp add " + (when contains(args, "server") then text(args["server"]) otherwise "?") + " (" + (when contains(args, "scope") then text(args["scope"]) otherwise "global") + ")"
     when name == "lsp"
         give "lsp " + (when contains(args, "op") then text(args["op"]) otherwise "?") + " " + (when contains(args, "path") then text(args["path"]) otherwise "?") + (when contains(args, "line") then ":" + text(args["line"]) + (when contains(args, "character") then ":" + text(args["character"]) otherwise "") otherwise "")
-    when name == "lamp"
+    when name == "plugin"
         let lact be when contains(args, "action") then text(args["action"]) otherwise "list"
-        give "lamp " + lact + (when lact != "list" then " " + (when contains(args, "name") then text(args["name"]) otherwise "?") otherwise "") + (when lact == "create" and contains(args, "files") then " [" + join(keys(args["files"]), ", ") + "]" otherwise "")
+        give "plugin " + lact + (when lact != "list" then " " + (when contains(args, "name") then text(args["name"]) otherwise "?") otherwise "") + (when lact == "create" and contains(args, "files") then " [" + join(keys(args["files"]), ", ") + "]" otherwise "")
     when name == "mcp"
         let act be when contains(args, "action") then text(args["action"]) otherwise "list"
         when act == "add"
@@ -160,13 +183,16 @@ export task describe_call(name, args)
         let sact be arg(args, "action", "list")
         when sact == "add"
             let what be arg(args, "kind", "?")
-            let body be when what == "lamp" then "lamp " + arg(args, "lamp", "?") + "." + arg(args, "tool", "?") + (when contains(args, "args") then " " + one_line(json_encode(args["args"]), 80) otherwise "") otherwise (when what == "bash" then "$ " + one_line(arg(args, "command", "?"), 120) otherwise "agent " + arg(args, "agent", "build") + ": " + one_line(arg(args, "prompt", "?"), 160))
+            let body be when what == "plugin" then "plugin " + arg(args, "plugin", "?") + "." + arg(args, "tool", "?") + (when contains(args, "args") then " " + one_line(json_encode(args["args"]), 80) otherwise "") otherwise (when what == "bash" then "$ " + one_line(arg(args, "command", "?"), 120) otherwise "agent " + arg(args, "agent", "build") + ": " + one_line(arg(args, "prompt", "?"), 160))
             give "schedule add «" + arg(args, "name", "?") + "» · " + arg(args, "at", "?") + " · " + body + " · permission " + arg(args, "permission", "ask") + (when contains(args, "notify") then " · notify " + text(args["notify"]) otherwise "")
         give "schedule " + sact + (when contains(args, "id") then " " + text(args["id"]) otherwise "")
     when name == "skill" and is_install(args)
         give "skill install " + text(args["source"]) + " --skill " + text(args["name"]) + " (" + (when contains(args, "scope") then text(args["scope"]) otherwise "global") + ")"
     when name == "bash"
         give "$ " + one_line(when contains(args, "command") then text(args["command"]) otherwise "", 160)
+    when name == "fetch"
+        let ffmt be arg(args, "format", "markdown")
+        give "fetch " + one_line(arg(args, "url", "?"), 140) + (when ffmt != "markdown" then " (" + ffmt + ")" otherwise "")
     -- lectura/búsqueda: como lo escribiría un humano en la shell
     when name == "read"
         let rng be when contains(args, "offset") or contains(args, "limit") then "  (" + (when contains(args, "offset") then "desde " + text(floor(number(text(args["offset"])))) otherwise "") + (when contains(args, "limit") then " " + text(floor(number(text(args["limit"])))) + " líneas" otherwise "") + ")" otherwise ""

package/lib/plugins.syn

@@ -0,0 +1,408 @@
+-- lib/plugins.syn — plugins: tools que el usuario (o el agente) escribe y el humano ENCIENDE
+--
+-- Qué es un plugin: una carpeta con un manifiesto `plugin.json` y el código que implementa sus tools.
+--   plugins/<nombre>/                     GLOBAL (lampson se instala una vez → vale para todos los proyectos)
+--   workspace/.lampson/plugins/<nombre>/  del PROYECTO (el agente puede crearlos con write: es su workspace)
+--   plugin.json = {"name", "description", "kind": "syn" | "exec",
+--                  "entry": "plugin.syn"          (kind=syn: un programa Synsema)
+--                  "command": "python plugin.py"  (kind=exec: cualquier ejecutable — js, py, sh…)
+--                  "caps": "file.read=workspace/*" (kind=syn, opcional: techo EXTRA sobre stdout,time,env=PLUGIN_*)
+--                  "timeout": 60,
+--                  "tools": [{"name", "description", "parameters": {JSON Schema}, "readonly": false}]}
+--
+-- Cómo corre (patrón "safe runner" de la doc 22-sandbox): cada llamada es UN proceso hijo que termina.
+--   kind=syn  → `synsema run --cap-set stdout,time,env=PLUGIN_*[,caps] <entry>`: el techo lo fija el
+--               manifiesto que el humano aprobó al encenderlo; un `require` de más en el código del
+--               plugin falla con "above the host ceiling" — no hay forma de escalar desde adentro.
+--   kind=exec → el comando tal cual (sin techo de lenguaje: por eso encender es SIEMPRE humano).
+--   La tool y sus args viajan por env: PLUGIN_TOOL, PLUGIN_ARGS (JSON), PLUGIN_DIR (carpeta del plugin,
+--   relativa a la raíz de lampson = cwd del hijo si kind=syn; si kind=exec el cwd es el workspace),
+--   PLUGIN_WORKSPACE (ruta real del proyecto). El plugin imprime el resultado (texto o JSON) por stdout.
+--
+-- Encendido: `.lampson/plugins.json` {"enabled": {"<nombre>": true}}. APAGADO por defecto: descubrir una
+-- carpeta nueva no lo activa; lo enciende el humano (UI: barra superior; terminal: /plugins on <nombre>) o el
+-- agente con la tool `plugin` (action=enable → ask SIEMPRE, como skill install / mcp add). Crear = write;
+-- encender = permiso. Sin `use` dinámico (Synsema no lo tiene, a propósito): nada de esto entra al proceso
+-- de lampson, solo corre como hijo.
+--
+-- Las tools encendidas entran al catálogo como `plugin_<plugin>_<tool>`; loop.execute las despacha acá
+-- (registry las marca con "plugin", como "mcp"). permission.syn: ask por defecto, yolo permite, strict deniega;
+-- las readonly también en plan/review/explore.
+--
+-- Compat (2026-09-01: antes se llamaban "lámparas"/lamps). Se siguen descubriendo las carpetas viejas
+-- `.lampson/lamps/<nombre>/` (marcadas `legacy: true` en summary; la UI y /plugins lo avisan), un `plugin.json`
+-- ausente cae a `lamp.json`, el estado cae a `.lampson/lamps.json` si `.lampson/plugins.json` no existe (se
+-- escribe siempre el nuevo), y el hijo recibe también LAMP_TOOL/LAMP_ARGS/LAMP_DIR/LAMP_WORKSPACE (el techo
+-- base incluye env=LAMP_*). Es un puente, no un formato: renombrá la carpeta y el manifiesto.
+
+use "./tools/common.syn" as c
+
+export let GLOBAL_DIR be "plugins"
+export let PROJECT_DIR be "workspace/.lampson/plugins"
+export let LEGACY_PROJECT_DIR be "workspace/.lampson/lamps"
+export let STATE_FILE be ".lampson/plugins.json"
+let LEGACY_STATE_FILE be ".lampson/lamps.json"
+export let PREFIX be "plugin_"
+export let LEGACY_HINT be "old .lampson/lamps/ folder — rename it to .lampson/plugins/ (and lamp.json to plugin.json)"
+let DEFAULT_TIMEOUT be 60
+let BASE_CAPS be "stdout,time,env=PLUGIN_*,env=LAMP_*"
+
+-- nombre de plugin: SIN "_" (el separador de plugin_<plugin>_<tool>); las tools sí pueden llevarlo
+task valid_name(name)
+    when name == nothing or name == ""
+        give false
+    give matches(text(name), "[a-zA-Z0-9-]{1,32}")
+
+task valid_tool_name(name)
+    when name == nothing or name == ""
+        give false
+    give matches(text(name), "[a-zA-Z0-9_-]{1,40}")
+
+-- lee y valida un manifiesto; devuelve {ok, plugin} o {ok: false, error}. `legacy` = viene de una carpeta vieja
+-- (o de un lamp.json): se lista igual, con el aviso.
+task read_manifest(dir, name, scope, legacy)
+    let path be dir + "/" + name + "/plugin.json"
+    let is_legacy be legacy
+    when not file_exists(path) and file_exists(dir + "/" + name + "/lamp.json")
+        set path to dir + "/" + name + "/lamp.json"
+        set is_legacy to true
+    let doc be nothing
+    try
+        set doc to json_decode(read_file(path))
+    recover err
+        give {"ok": false, "name": name, "scope": scope, "legacy": is_legacy, "error": "no plugin.json: " + text(err)}
+    let kind be when contains(doc, "kind") then lower(text(doc["kind"])) otherwise "syn"
+    when kind != "syn" and kind != "exec"
+        give {"ok": false, "name": name, "scope": scope, "legacy": is_legacy, "error": "kind must be syn or exec"}
+    when kind == "syn" and not contains(doc, "entry")
+        give {"ok": false, "name": name, "scope": scope, "legacy": is_legacy, "error": "kind=syn needs \"entry\" (the .syn file)"}
+    when kind == "exec" and not contains(doc, "command")
+        give {"ok": false, "name": name, "scope": scope, "legacy": is_legacy, "error": "kind=exec needs \"command\""}
+    when not contains(doc, "tools") or length(doc["tools"]) == 0
+        give {"ok": false, "name": name, "scope": scope, "legacy": is_legacy, "error": "no tools declared"}
+    let tools be []
+    each t in doc["tools"]
+        when not contains(t, "name") or not valid_tool_name(t["name"])
+            give {"ok": false, "name": name, "scope": scope, "legacy": is_legacy, "error": "a tool has no valid name"}
+        set tools to append(tools, {"name": text(t["name"]), "description": when contains(t, "description") then text(t["description"]) otherwise "", "parameters": when contains(t, "parameters") then t["parameters"] otherwise {"type": "object", "properties": {}}, "readonly": contains(t, "readonly") and t["readonly"] == true})
+    give {"ok": true, "name": name, "scope": scope, "legacy": is_legacy, "plugin": {"name": name, "scope": scope, "dir": dir + "/" + name, "kind": kind, "legacy": is_legacy, "description": when contains(doc, "description") then text(doc["description"]) otherwise "", "entry": when contains(doc, "entry") then text(doc["entry"]) otherwise "", "command": when contains(doc, "command") then text(doc["command"]) otherwise "", "caps": when contains(doc, "caps") then text(doc["caps"]) otherwise "", "timeout": when contains(doc, "timeout") then floor(number(doc["timeout"])) otherwise DEFAULT_TIMEOUT, "tools": tools}}
+
+task scan(dir, scope, legacy)
+    let out be []
+    try
+        each e in list_dir(dir)
+            when e["is_dir"] and valid_name(e["name"])
+                set out to append(out, read_manifest(dir, e["name"], scope, legacy))
+    recover err
+        give out
+    give out
+
+-- estado de encendido: el archivo nuevo; si no existe todavía, el viejo (solo lectura — se escribe siempre el nuevo)
+task load_state()
+    let f be when file_exists(STATE_FILE) then STATE_FILE otherwise LEGACY_STATE_FILE
+    try
+        let doc be json_decode(read_file(f))
+        give when contains(doc, "enabled") then doc["enabled"] otherwise {}
+    recover err
+        give {}
+
+-- todos los plugins descubiertos (proyecto pisa a global por nombre; la carpeta nueva pisa a la vieja), con
+-- enabled, legacy y error. LAMPSON_PLUGINS_DIR = una carpeta extra (tests).
+export task all()
+    require file(".lampson")
+    require file(".lampson/*")
+    require file.read("plugins")
+    require file.read("plugins/*")
+    require file("workspace")
+    require file("workspace/*")
+    require env("LAMPSON_*")
+    let by_name be {}
+    each r in scan(GLOBAL_DIR, "global", false)
+        set by_name[r["name"]] to r
+    each r in scan(LEGACY_PROJECT_DIR, "project", true)
+        set by_name[r["name"]] to r
+    each r in scan(PROJECT_DIR, "project", false)
+        set by_name[r["name"]] to r
+    when env("LAMPSON_PLUGINS_DIR", "") != ""
+        each r in scan(env("LAMPSON_PLUGINS_DIR", ""), "extra", false)
+            set by_name[r["name"]] to r
+    let st be load_state()
+    let out be []
+    each n in sort_by(keys(by_name), (x) => x)
+        let r be by_name[n]
+        let on be contains(st, n) and st[n] == true
+        when r["ok"]
+            let l be r["plugin"]
+            set l["enabled"] to on
+            set l["error"] to nothing
+            set out to append(out, l)
+        otherwise
+            set out to append(out, {"name": n, "scope": r["scope"], "dir": "", "kind": "?", "legacy": r["legacy"], "description": "", "entry": "", "command": "", "caps": "", "timeout": 0, "tools": [], "enabled": false, "error": r["error"]})
+    give out
+
+export task enabled()
+    require file(".lampson")
+    require file(".lampson/*")
+    require file.read("plugins")
+    require file.read("plugins/*")
+    require file("workspace")
+    require file("workspace/*")
+    require env("LAMPSON_*")
+    give where(all(), (l) => l["enabled"] and l["error"] == nothing)
+
+-- encender/apagar (el humano, o el agente tras aprobación). Encender un plugin roto es error.
+export task set_enabled(name, on)
+    require file(".lampson")
+    require file(".lampson/*")
+    require file.read("plugins")
+    require file.read("plugins/*")
+    require file("workspace")
+    require file("workspace/*")
+    require env("LAMPSON_*")
+    when not valid_name(name)
+        raise("invalid plugin name")
+    let found be where(all(), (l) => l["name"] == name)
+    when length(found) == 0
+        raise("no plugin named '" + name + "' (global: " + GLOBAL_DIR + "/<name>/plugin.json · project: " + PROJECT_DIR + "/<name>/plugin.json)")
+    when on and found[0]["error"] != nothing
+        raise("plugin '" + name + "' is broken: " + text(found[0]["error"]))
+    let st be load_state()
+    set st[name] to on == true
+    write_file(STATE_FILE, json_encode({"enabled": st}))
+    let l be found[0]
+    let legacy_note be when l["legacy"] then " · NOTE: " + LEGACY_HINT otherwise ""
+    when on
+        give "plugin '" + name + "' ON (" + l["kind"] + ", " + text(length(l["tools"])) + " tools" + (when l["kind"] == "syn" then ", ceiling: " + ceiling_of(l) otherwise ", NO capability ceiling: exec") + ") — its tools are in the catalog from the next turn as " + PREFIX + name + "_<tool>" + legacy_note
+    give "plugin '" + name + "' OFF" + legacy_note
+
+task ceiling_of(l)
+    give when l["caps"] == "" then BASE_CAPS otherwise BASE_CAPS + "," + l["caps"]
+
+-- ---------- catálogo ----------
+export task tool_name(plugin, tool)
+    give PREFIX + plugin + "_" + tool
+
+task split_name(full)
+    let segs be split(slice(full, length(PREFIX), length(full)), "_")
+    when length(segs) < 2
+        raise("bad plugin tool name '" + full + "'")
+    give {"plugin": segs[0], "tool": join(slice(segs, 1, length(segs)), "_")}
+
+export task catalog(readonly_only)
+    require file(".lampson")
+    require file(".lampson/*")
+    require file.read("plugins")
+    require file.read("plugins/*")
+    require file("workspace")
+    require file("workspace/*")
+    require env("LAMPSON_*")
+    let out be []
+    each l in enabled()
+        each t in l["tools"]
+            when not readonly_only or t["readonly"]
+                set out to append(out, {"name": tool_name(l["name"], t["name"]), "description": "[plugin " + l["name"] + "] " + t["description"], "parameters": t["parameters"]})
+    give out
+
+export task names(readonly_only)
+    require file(".lampson")
+    require file(".lampson/*")
+    require file.read("plugins")
+    require file.read("plugins/*")
+    require file("workspace")
+    require file("workspace/*")
+    require env("LAMPSON_*")
+    give apply(catalog(readonly_only), (s) => s["name"])
+
+-- ---------- llamada: un proceso hijo por invocación ----------
+task run_child(exe, argv, cwd, envs, t)
+    let p be proc_spawn(exe, argv, {"cwd": cwd, "env": envs, "stderr": "merge", "on_full": "drop_oldest"})
+    proc_close_stdin(p)
+    let deadline be now() + t
+    let lines be []
+    let code be nothing
+    let timed_out be false
+    while code == nothing and not timed_out
+        let left be deadline - now()
+        when left <= 0
+            set timed_out to true
+        otherwise
+            let ev be proc_recv(p, when left < 0.2 then 0.2 otherwise left)
+            when ev == nothing
+                set timed_out to now() >= deadline
+            otherwise when ev["type"] == "exit"
+                set code to ev["data"]["exit_code"]
+            otherwise
+                set lines to append(lines, ev["data"])
+    proc_close(p)
+    let out be join(lines, "\n")
+    when timed_out
+        give "ERROR: plugin timed out after " + text(t) + "s (killed). Output so far:\n" + out
+    when code != 0
+        give "ERROR: plugin exited with code " + text(code) + "\n" + out
+    give when trim(out) == "" then "(no output)" otherwise out
+
+-- separa "python plugin.py --x" en exe + args (comillas simples/dobles respetadas)
+export task split_command(line)
+    let toks be []
+    let cur be ""
+    let q be ""
+    let has be false
+    let i be 0
+    while i < length(line)
+        let ch be slice(line, i, i + 1)
+        set i to i + 1
+        when q != ""
+            when ch == q
+                set q to ""
+            otherwise
+                set cur to cur + ch
+        otherwise when ch == "\"" or ch == "'"
+            set q to ch
+            set has to true
+        otherwise when ch == " " or ch == "\t"
+            when cur != "" or has
+                set toks to append(toks, cur)
+                set cur to ""
+                set has to false
+        otherwise
+            set cur to cur + ch
+    when cur != "" or has
+        set toks to append(toks, cur)
+    give toks
+
+export task call(full_name, args)
+    require exec
+    require time
+    require file(".lampson")
+    require file(".lampson/*")
+    require file.read("plugins")
+    require file.read("plugins/*")
+    require file("workspace")
+    require file("workspace/*")
+    require env("LAMPSON_*")
+    let parts be split_name(full_name)
+    let found be where(enabled(), (l) => l["name"] == parts["plugin"])
+    when length(found) == 0
+        give "ERROR: plugin '" + parts["plugin"] + "' is not enabled (the user turns plugins on)"
+    let l be found[0]
+    let tl be where(l["tools"], (t) => t["name"] == parts["tool"])
+    when length(tl) == 0
+        give "ERROR: plugin '" + l["name"] + "' has no tool '" + parts["tool"] + "'"
+    -- PLUGIN_DIR relativa a la raíz de lampson (cwd del hijo para kind=syn); PLUGIN_WORKSPACE = la ruta real del
+    -- proyecto (lampson.ps1 la exporta; sin ella, la junction). LAMP_* = los nombres viejos, por compat.
+    let tool_args be json_encode(when args == nothing then {} otherwise args)
+    let ws be env("LAMPSON_WORKSPACE", c.ROOT)
+    let envs be {"PLUGIN_TOOL": parts["tool"], "PLUGIN_ARGS": tool_args, "PLUGIN_DIR": l["dir"], "PLUGIN_WORKSPACE": ws, "LAMP_TOOL": parts["tool"], "LAMP_ARGS": tool_args, "LAMP_DIR": l["dir"], "LAMP_WORKSPACE": ws}
+    when l["kind"] == "syn"
+        -- techo del manifiesto: el código del plugin no puede pedir más de lo que el humano aprobó
+        give c.truncate(run_child(env("LAMPSON_SYNSEMA", "synsema"), ["run", "--cap-set", ceiling_of(l), l["dir"] + "/" + l["entry"]], ".", envs, l["timeout"]), c.MAX_OUTPUT)
+    let argv be split_command(l["command"])
+    when length(argv) == 0
+        give "ERROR: plugin '" + l["name"] + "' has an empty command"
+    -- el comando corre desde la RAÍZ DEL WORKSPACE (para que "python plugin.py" vea el proyecto), así que un
+    -- token que nombra un archivo de la carpeta del plugin se resuelve solo (2026-08-28: "python lamp.py"
+    -- salía con code 2 porque lamp.py no estaba en el cwd)
+    let rel_dir be when starts_with(l["dir"], c.ROOT + "/") then slice(l["dir"], length(c.ROOT) + 1, length(l["dir"])) otherwise "../" + l["dir"]
+    let resolved be []
+    each tok in argv
+        when not contains(tok, "/") and not contains(tok, "\\") and file_exists(l["dir"] + "/" + tok)
+            set resolved to append(resolved, rel_dir + "/" + tok)
+        otherwise
+            set resolved to append(resolved, tok)
+    give c.truncate(run_child(resolved[0], slice(resolved, 1, length(resolved)), c.ROOT, envs, l["timeout"]), c.MAX_OUTPUT)
+
+-- crear un plugin DEL PROYECTO (workspace/.lampson/plugins/<name>/): escribe plugin.json + el código, revalida el
+-- manifiesto y, si es syn, corre `synsema check` sobre el entry. Como cordis_define en dsh: define y valida,
+-- NO ejecuta ni enciende — encender sigue siendo del humano (set_enabled tras ask).
+-- `files` = {"plugin.syn": "…", "helper.py": "…"}: nombres simples (sin / ni ..) dentro de la carpeta.
+export task create(name, manifest, files)
+    require exec
+    require time
+    require file(".lampson")
+    require file(".lampson/*")
+    require file.read("plugins")
+    require file.read("plugins/*")
+    require file("workspace")
+    require file("workspace/*")
+    require env("LAMPSON_*")
+    when not valid_name(name)
+        raise("invalid plugin name '" + text(name) + "': letters, digits and - only (no _), max 32")
+    when manifest == nothing or not contains(manifest, "tools")
+        raise("manifest needs at least \"tools\" (and \"entry\" for kind=syn or \"command\" for kind=exec)")
+    let dir be PROJECT_DIR + "/" + name
+    let m be manifest
+    set m["name"] to name
+    when not contains(m, "kind")
+        set m["kind"] to "syn"
+    write_file(dir + "/plugin.json", json_encode(m))
+    let written be ["plugin.json"]
+    when files != nothing
+        each fname in keys(files)
+            when not matches(fname, "[A-Za-z0-9_.-]{1,64}") or starts_with(fname, ".")
+                raise("bad file name '" + fname + "' (simple names inside the plugin folder only)")
+            write_file(dir + "/" + fname, text(files[fname]))
+            set written to append(written, fname)
+    let found be where(all(), (l) => l["name"] == name)
+    when length(found) == 0
+        raise("plugin written but not discovered (?)")
+    let l be found[0]
+    when l["error"] != nothing
+        give "plugin '" + name + "' written to " + dir + " but its manifest is INVALID: " + text(l["error"]) + " — fix it with edit and call plugin(action=list) to re-check"
+    let note be ""
+    when l["kind"] == "syn"
+        let chk be run_child(env("LAMPSON_SYNSEMA", "synsema"), ["check", l["dir"] + "/" + l["entry"]], ".", {}, 30)
+        when starts_with(chk, "ERROR")
+            give "plugin '" + name + "' written to " + dir + " but `synsema check " + l["entry"] + "` FAILED:\n" + chk + "\nFix the code with edit; it stays off until it checks and the user turns it on."
+        set note to " · synsema check OK · ceiling when on: " + ceiling_of(l)
+    when l["kind"] == "exec"
+        set note to " · exec (no capability ceiling: the user will see that when approving)"
+    give "plugin '" + name + "' created (project, " + l["kind"] + ", " + text(length(l["tools"])) + " tools: " + join(apply(l["tools"], (t) => t["name"]), ", ") + ") in " + dir + " [" + join(written, ", ") + "]" + note + (when l["kind"] == "exec" then ". The command runs from the workspace root; a file of the plugin folder named in the command is resolved automatically" otherwise "") + ". It is OFF until the user turns it on: offer to do it (plugin action=enable asks them), or point them to the plugin switch of their UI. Its tools will be " + PREFIX + name + "_<tool>."
+
+-- eliminar un plugin DEL PROYECTO: borra su carpeta (no hay delete_file en el runtime → rm -rf por el shell
+-- de bash.syn) y lo saca del estado. Los globales (plugins/) se borran a mano: son de la instalación, no del repo.
+export task remove(name)
+    require exec
+    require time
+    require env("LAMPSON_*")
+    require env("OS")
+    require file(".lampson")
+    require file(".lampson/*")
+    require file.read("plugins")
+    require file.read("plugins/*")
+    require file("workspace")
+    require file("workspace/*")
+    when not valid_name(name)
+        raise("invalid plugin name")
+    let found be where(all(), (l) => l["name"] == name)
+    when length(found) == 0
+        raise("no plugin named '" + name + "'")
+    let l be found[0]
+    when l["scope"] != "project"
+        raise("'" + name + "' is a " + l["scope"] + " plugin (" + GLOBAL_DIR + "/" + name + "): delete that folder by hand")
+    let dir be when l["dir"] != "" then l["dir"] otherwise PROJECT_DIR + "/" + name
+    let is_win be env("OS", "") == "Windows_NT"
+    let sh be env("LAMPSON_SHELL", when is_win then "C:\\Program Files\\Git\\bin\\bash.exe" otherwise "bash")
+    let r be run(sh, ["-c", "rm -rf '" + dir + "'"], 30, {"cwd": "."})
+    when file_exists(dir + "/plugin.json") or file_exists(dir + "/lamp.json")
+        raise("could not delete " + dir + ": " + text(r["stderr"]))
+    let st be load_state()
+    let clean be {}
+    each k in keys(st)
+        when k != name
+            set clean[k] to st[k]
+    write_file(STATE_FILE, json_encode({"enabled": clean}))
+    give "plugin '" + name + "' deleted (" + dir + ")"
+
+-- resumen para UI/terminal/tool
+export task summary()
+    require file(".lampson")
+    require file(".lampson/*")
+    require file.read("plugins")
+    require file.read("plugins/*")
+    require file("workspace")
+    require file("workspace/*")
+    require env("LAMPSON_*")
+    let out be []
+    each l in all()
+        set out to append(out, {"name": l["name"], "scope": l["scope"], "kind": l["kind"], "legacy": l["legacy"], "description": l["description"], "enabled": l["enabled"], "error": l["error"], "caps": when l["kind"] == "syn" and l["error"] == nothing then ceiling_of(l) otherwise "", "command": when l["kind"] == "exec" then l["command"] otherwise "", "tools": apply(l["tools"], (t) => t["name"]), "tool_specs": l["tools"], "dir": l["dir"]})
+    give out

package/lib/prompt.syn

@@ -53,10 +53,11 @@ Operate like a careful senior engineer: precise, honest, and economical with wor
 
 # Tools
 - read (offset/limit), ls, find (glob), grep (regex): use them instead of bash with cat/ls/find/grep — line-numbered and cheaper. lsp (symbols/definition/references/hover): the file's structure without reading it, and exact navigation when grep is ambiguous — prefer lsp symbols plus a ranged read over reading a big file whole. edit: targeted replacement. write: create or fully replace.
+- fetch (url, format, max_chars): web pages and HTTP APIs as Markdown — docs, READMEs, issues, changelogs, JSON. Use it instead of bash with curl/wget for anything you will read: it asks the site for Markdown first and strips scripts, styles and navigation, so a page costs a tenth of its HTML. A long page comes back head+tail with the full text saved to a file: read (offset/limit) or grep that file, never fetch the same URL again. Cite the URL when you use its content. Use bash+curl only for POST, custom headers or downloads.
 - bash: shell commands from the workspace root. State does not persist between calls (cd resets) — chain with &&. Check the [exit code: N] marker on every result (it is the last line) and investigate failures before moving on. Never pipe a build or test through head/tail: the output is already truncated for you (the full text is saved to a file whose path you get) and the pipe hides the real exit code. Never run a server or watcher here.
 - process: start/logs/stop long-running commands (dev servers, watchers). Their new log lines arrive automatically with every later tool result — do not sleep or poll. Stop what you started when the task is done.
 - delegate: sub-agents with a fresh context (explore, plan, review, worker); several tasks in one call run in parallel, background=true returns at once and the report arrives later as a message. Give a highly detailed, self-contained brief, say whether it should write code or only research, how to verify, and exactly what to return. Its report is a self-report — verify what matters before telling the user it is done. Its output is not visible to the user: summarise it.
-- memory: durable facts across sessions (user preferences, environment details, tool quirks, conventions). Check it before investigating. Write declarative facts, not instructions to yourself; do not store task progress or anything stale in a week.
+- memory: durable facts across sessions (user preferences, environment details, tool quirks, conventions). Check it before investigating. Write declarative facts, not instructions to yourself; do not store task progress or anything stale in a week. The notes live outside the project: only this tool reaches them (never ls/bash, never files inside the repo).
 - skill: before starting a kind of task, scan the skill list below; if one matches or is even partially relevant, load it and follow it. Err on the side of loading.
 - todo: your task list (whole-list replacement, one in_progress at a time; see Method step 1).
 - MCP tools are named mcp_<server>_<tool>; calling one may ask the user for approval. The mcp tool lists, connects (action=add, with the user's approval) and disconnects servers; a new server's tools enter your catalog on the next turn.
@@ -70,6 +71,6 @@ Concise and direct; lead with the change or the answer, not a preamble. Prefer t
 - OS: {env_info["os"]}   Shell used by bash tool: {env_info["shell"]}
 - Date: {env_info["date"]}
 - Model: {env_info["model"]} via {env_info["provider"]}
-- The user talks to you from the {env_info["ui"]} UI. When something needs the user's hand (turning a lamp on, adding an LSP server, connecting an MCP), tell them the way that exists in THEIR UI: web → the «lámparas» switch / the LSP and MCP sections of the sidebar; terminal → /lamps on <name>, /lsp add <preset>, /mcp add. Never tell a web user to type a slash command — or simply offer to do it yourself (the tool asks them for approval).`
+- The user talks to you from the {env_info["ui"]} UI. When something needs the user's hand (turning a plugin on, adding an LSP server, connecting an MCP), tell them the way that exists in THEIR UI: web → the «plugins» switch / the LSP and MCP sections of the sidebar; terminal → /plugins on <name>, /lsp add <preset>, /mcp add. Never tell a web user to type a slash command — or simply offer to do it yourself (the tool asks them for approval).`
     let mode be when addendum == nothing then "" otherwise (when addendum == "" then "" otherwise "\n\n# Mode\n" + addendum)
     give core + mode + skills.prompt_section(skills.index()) + memo.prompt_section() + read_context_files()