lampson 0.2.6 → 0.2.8

package/lib/tools/url.syn

@@ -0,0 +1,220 @@
+-- lib/tools/url.syn — URLs para la tool fetch y para permission.syn (puro, sin capacidades)
+--
+--   parse(url)        → {ok, error?, url, scheme, host, port, path, query, origin, dir}
+--   host_class(host)  → "public" | "private" | "blocked"
+--   sensitive(url)    → motivo (texto) si la URL lleva una credencial, o nothing
+--   resolve(base, href) → URL absoluta de un href (relativo o no), o nothing si no es navegable (#, javascript:)
+--
+-- Política de hosts (tomada de hermes url_safety.py, sin resolver DNS: el runtime no expone un resolver):
+--   * "blocked": endpoints de metadata de la nube (169.254.169.254 y familia, metadata.google.internal).
+--     Nunca son un destino legítimo: se deniegan SIEMPRE, incluso en yolo.
+--   * "private": loopback, redes privadas (10/8, 172.16/12, 192.168/16, CGNAT 100.64/10), link-local,
+--     localhost y sufijos internos. Legítimo para mirar el propio dev server → PIDE aprobación (yolo permite,
+--     strict deniega). Un host numérico ambiguo (entero, hex, octal) cae aquí también.
+--   * "public": el resto. Límite conocido: sin DNS no se detecta un nombre público que resuelve a una IP
+--     privada (DNS rebinding); hermes lo cubre con un resolver, aquí queda documentado.
+
+let SENSITIVE_PARAMS be ["access_token", "api_key", "apikey", "auth_token", "authorization", "awsaccesskeyid", "client_secret", "credential", "credentials", "jwt", "password", "passwd", "secret", "session_id", "signature", "token", "private_key", "x_amz_security_token", "x_amz_signature", "x-amz-security-token", "x-amz-signature"]
+let SECRET_RE be "(?i)(\\bsk-(ant-|proj-)?[a-z0-9_-]{24,}|\\bghp_[a-z0-9]{20,}|\\bgithub_pat_[a-z0-9_]{20,}|\\bgho_[a-z0-9]{20,}|\\bglpat-[a-z0-9_-]{16,}|\\bxox[abprs]-[a-z0-9-]{10,}|\\bakia[0-9a-z]{16}\\b|\\baiza[0-9a-z_-]{30,}|-----begin [a-z ]*private key|\\beyj[a-z0-9_-]{20,}\\.eyj[a-z0-9_-]{20,})"
+
+task fail(msg)
+    give {"ok": false, "error": msg}
+
+export task parse(raw)
+    when raw == nothing
+        give fail("missing URL")
+    let u be trim(text(raw))
+    -- "https:// host" — el modelo a veces mete un espacio tras el esquema (hermes normalize_url_for_request)
+    set u to replace_re(u, "^([A-Za-z][A-Za-z0-9+.-]*://)\\s+", "\\1")
+    when u == ""
+        give fail("missing URL")
+    when length(u) > 2048
+        give fail("URL longer than 2048 chars")
+    when contains(u, " ") or contains(u, "\n") or contains(u, "\t")
+        give fail("URL contains whitespace: " + u)
+    let sp be split(u, "://")
+    when length(sp) < 2
+        give fail("not an absolute http(s) URL: " + u)
+    let scheme be lower(sp[0])
+    when scheme != "http" and scheme != "https"
+        give fail("unsupported scheme '" + scheme + "' (only http and https)")
+    let rest be join(slice(sp, 1, length(sp)), "://")
+    -- fragmento y query
+    let frag_sp be split(rest, "#")
+    set rest to frag_sp[0]
+    let q_sp be split(rest, "?")
+    let query be when length(q_sp) > 1 then join(slice(q_sp, 1, length(q_sp)), "?") otherwise ""
+    set rest to q_sp[0]
+    -- autoridad y path
+    let slash_sp be split(rest, "/")
+    let authority be slash_sp[0]
+    let path be when length(slash_sp) > 1 then "/" + join(slice(slash_sp, 1, length(slash_sp)), "/") otherwise "/"
+    when contains(authority, "@")
+        give fail("credentials in the URL are not allowed")
+    when authority == ""
+        give fail("missing host: " + u)
+    let host be lower(authority)
+    let port be ""
+    when starts_with(host, "[")
+        -- IPv6 literal: [::1]:8080
+        let close be split(host, "]")
+        set host to slice(close[0], 1, length(close[0]))
+        when length(close) > 1 and starts_with(close[1], ":")
+            set port to slice(close[1], 1, length(close[1]))
+    otherwise
+        let hp be split(host, ":")
+        when length(hp) > 2
+            give fail("malformed host: " + authority)
+        set host to hp[0]
+        when length(hp) == 2
+            set port to hp[1]
+    when port != "" and not matches(port, "[0-9]{1,5}")
+        give fail("malformed port: " + port)
+    -- "example.com." (FQDN con punto final) ≡ "example.com"
+    while ends_with(host, ".")
+        set host to slice(host, 0, length(host) - 1)
+    when host == ""
+        give fail("missing host: " + u)
+    let origin be scheme + "://" + host + (when port != "" then ":" + port otherwise "")
+    let dir_parts be split(path, "/")
+    let dir be join(slice(dir_parts, 0, length(dir_parts) - 1), "/") + "/"
+    give {"ok": true, "url": origin + path + (when query != "" then "?" + query otherwise ""), "scheme": scheme, "host": host, "port": port, "path": path, "query": query, "origin": origin, "dir": dir}
+
+-- octetos de una IPv4 en notación decimal con puntos, o nothing
+task ipv4_octets(host)
+    when not matches(host, "[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}")
+        give nothing
+    let out be []
+    each p in split(host, ".")
+        let n be floor(number(p))
+        when n > 255
+            give nothing
+        set out to append(out, n)
+    give out
+
+task ipv4_class(o)
+    let a be o[0]
+    let b be o[1]
+    when a == 169 and b == 254
+        give "blocked"
+    when a == 100 and b == 100 and o[2] == 100 and o[3] == 200
+        give "blocked"
+    when a == 127 or a == 10 or a == 0
+        give "private"
+    when a == 192 and b == 168
+        give "private"
+    when a == 172 and b >= 16 and b <= 31
+        give "private"
+    when a == 100 and b >= 64 and b <= 127
+        give "private"
+    when a >= 224
+        give "private"
+    give "public"
+
+export task host_class(host)
+    let h be lower(text(host))
+    when h == "metadata.google.internal" or h == "metadata.goog" or h == "fd00:ec2::254"
+        give "blocked"
+    let o be ipv4_octets(h)
+    when o != nothing
+        give ipv4_class(o)
+    -- IPv6: loopback, unspecified, ULA fc00::/7, link-local fe80::/10, IPv4 mapeadas ::ffff:a.b.c.d
+    when contains(h, ":")
+        when h == "::1" or h == "::"
+            give "private"
+        when starts_with(h, "::ffff:")
+            let inner be ipv4_octets(slice(h, 7, length(h)))
+            give when inner != nothing then ipv4_class(inner) otherwise "private"
+        when starts_with(h, "fc") or starts_with(h, "fd") or starts_with(h, "fe8") or starts_with(h, "fe9") or starts_with(h, "fea") or starts_with(h, "feb")
+            give "private"
+        give "public"
+    when h == "localhost" or ends_with(h, ".localhost") or ends_with(h, ".internal") or ends_with(h, ".local") or ends_with(h, ".home.arpa") or ends_with(h, ".lan")
+        give "private"
+    -- formas numéricas ambiguas (2130706433, 0x7f000001, 0177.0.0.1): clásicos de bypass → tratar como privado
+    when matches(h, "[0-9]+") or matches(h, "0x[0-9a-f]+") or matches(h, "[0-9x.]+")
+        give "private"
+    give "public"
+
+-- %XX → carácter (para inspeccionar una URL con secretos codificados)
+task percent_decode(s)
+    let out be s
+    each m in find_all(s, "%[0-9A-Fa-f]{2}")
+        let ch be nothing
+        try
+            set ch to json_decode("\"\\u00" + slice(m, 1, 3) + "\"")
+        recover e
+            set ch to nothing
+        when ch != nothing
+            set out to replace_text(out, m, ch)
+    give out
+
+export task sensitive(raw)
+    when raw == nothing
+        give nothing
+    let u be text(raw)
+    let decoded be percent_decode(u)
+    when length(find_all(u, SECRET_RE)) > 0 or length(find_all(decoded, SECRET_RE)) > 0
+        give "an API key or token"
+    let p be parse(u)
+    when not p["ok"]
+        give nothing
+    when p["query"] == ""
+        give nothing
+    each pair in split(p["query"], "&")
+        let kv be split(pair, "=")
+        let k be lower(trim(percent_decode(kv[0])))
+        let v be when length(kv) > 1 then join(slice(kv, 1, length(kv)), "=") otherwise ""
+        when v != "" and contains(SENSITIVE_PARAMS, k)
+            give "a credential-like query parameter (" + kv[0] + ")"
+    give nothing
+
+-- "/a/b/../c/./d" → "/a/c/d"
+task normalize_path(path)
+    let out be []
+    each seg in split(path, "/")
+        when seg == ".."
+            when length(out) > 0
+                set out to slice(out, 0, length(out) - 1)
+        otherwise when seg != "." and seg != ""
+            set out to append(out, seg)
+    give "/" + join(out, "/") + (when ends_with(path, "/") and length(out) > 0 then "/" otherwise "")
+
+export task resolve(base, href)
+    when href == nothing
+        give nothing
+    let h be trim(text(href))
+    let lh be lower(h)
+    when h == "" or starts_with(h, "#") or starts_with(lh, "javascript:") or starts_with(lh, "data:") or starts_with(lh, "mailto:") or starts_with(lh, "tel:")
+        give nothing
+    when matches(h, "[A-Za-z][A-Za-z0-9+.-]*:.*")
+        give h
+    let b be parse(base)
+    when not b["ok"]
+        give h
+    when starts_with(h, "//")
+        give b["scheme"] + ":" + h
+    -- separar query/fragmento del path relativo para normalizar solo el path
+    let tail be ""
+    let core be h
+    let qi be split(h, "?")
+    let fi be split(h, "#")
+    when length(qi) > 1
+        set core to qi[0]
+        set tail to "?" + join(slice(qi, 1, length(qi)), "?")
+    otherwise when length(fi) > 1
+        set core to fi[0]
+        set tail to "#" + join(slice(fi, 1, length(fi)), "#")
+    when core == ""
+        give b["origin"] + b["path"] + tail
+    when starts_with(core, "/")
+        give b["origin"] + normalize_path(core) + tail
+    give b["origin"] + normalize_path(b["dir"] + core) + tail
+
+-- nombre de archivo estable para la caché/spill de una URL: fetch-<host>-<digest>
+export task slug(host)
+    let s be replace_re(lower(text(host)), "[^a-z0-9._-]", "-")
+    when length(s) > 60
+        set s to slice(s, 0, 60)
+    when s == ""
+        give "page"
+    give s

package/lib/tools.syn

@@ -19,13 +19,14 @@ use "./tools/ls.syn" as t_ls
 use "./tools/find.syn" as t_find
 use "./tools/grep.syn" as t_grep
 use "./tools/bash.syn" as t_bash
+use "./tools/fetch.syn" as t_fetch
 use "./tools/skill.syn" as t_skill
 use "./tools/process.syn" as t_process
 use "./tools/memo.syn" as t_memo
 use "./tools/todo.syn" as t_todo
 use "./skills.syn" as skills
 use "./mcp.syn" as mcp
-use "./lamps.syn" as lamps
+use "./plugins.syn" as plugins
 use "./lsp.syn" as lsp
 use "./schedule.syn" as schedule
 
@@ -86,40 +87,40 @@ let MCP_SPEC be {
     }, "required": ["action"]}
 }
 
--- la task de la tool lamp (lamps.syn vive un nivel arriba de tools/, como mcp). enable/disable piden humano
+-- la task de la tool plugin (plugins.syn vive un nivel arriba de tools/, como mcp). enable/disable piden humano
 -- SIEMPRE (permission.syn): encender = autorizar código a correr con las capacidades de su manifiesto.
-task lamp_tool(action, name, manifest, files)
+task plugin_tool(action, name, manifest, files)
     require exec
     require time
     require env("LAMPSON_*")
     require file(".lampson")
     require file(".lampson/*")
-    require file.read("lamps")
-    require file.read("lamps/*")
+    require file.read("plugins")
+    require file.read("plugins/*")
     require file("workspace")
     require file("workspace/*")
     when action == "create"
-        give lamps.create(name, manifest, files)
+        give plugins.create(name, manifest, files)
     when action == "enable"
-        give lamps.set_enabled(name, true)
+        give plugins.set_enabled(name, true)
     when action == "disable"
-        give lamps.set_enabled(name, false)
-    let sm be lamps.summary()
+        give plugins.set_enabled(name, false)
+    let sm be plugins.summary()
     when length(sm) == 0
-        give "no lamps found. A lamp is a folder with a lamp.json manifest: " + lamps.GLOBAL_DIR + "/<name>/ (global) or " + lamps.PROJECT_DIR + "/<name>/ (this project; you can create it with write). See the lampson skill for the manifest format."
+        give "no plugins found. A plugin is a folder with a plugin.json manifest: " + plugins.GLOBAL_DIR + "/<name>/ (global) or " + plugins.PROJECT_DIR + "/<name>/ (this project; you can create it with write). See the lampson skill for the manifest format."
     let lines be []
     each l in sm
-        set lines to append(lines, l["name"] + " (" + l["scope"] + ", " + l["kind"] + ", " + (when l["enabled"] then "ON" otherwise "off") + "): " + (when l["error"] != nothing then "BROKEN — " + text(l["error"]) otherwise text(length(l["tools"])) + " tools [" + join(l["tools"], ", ") + "]" + (when l["description"] != "" then " — " + l["description"] otherwise "")))
+        set lines to append(lines, l["name"] + " (" + l["scope"] + ", " + l["kind"] + ", " + (when l["enabled"] then "ON" otherwise "off") + "): " + (when l["error"] != nothing then "BROKEN — " + text(l["error"]) otherwise text(length(l["tools"])) + " tools [" + join(l["tools"], ", ") + "]" + (when l["description"] != "" then " — " + l["description"] otherwise "")) + (when l["legacy"] then " [" + plugins.LEGACY_HINT + "]" otherwise ""))
     give join(lines, "\n")
 
-let LAMP_SPEC be {
-    "name": "lamp",
-    "description": "Lamps are tool plugins you can build for this project: a folder with a lamp.json manifest plus code — a Synsema program (kind=syn) run under a capability ceiling, or any executable (kind=exec). Consider one when a task needs a reusable custom tool (a project-specific query, generator, checker) that plain bash would repeat clumsily. action=list (default): every lamp found, on/off, its tools. action=create: write a PROJECT lamp (name + manifest + files) — it validates the manifest and runs `synsema check` on a syn entry, but does NOT run or enable it. action=enable / disable: turn one on or off — ALWAYS asks the user (enabling authorizes its code to run with the manifest's capabilities). An enabled lamp's tools appear in your catalog as lamp_<lamp>_<tool> from the NEXT turn. Manifest: {\"description\", \"kind\": \"syn\"|\"exec\", \"entry\": \"lamp.syn\" (syn) | \"command\": \"python lamp.py\" (exec), \"caps\": \"file.read=workspace/*\" (syn, optional extra ceiling over stdout,time,env=LAMP_*), \"timeout\": 60, \"tools\": [{\"name\", \"description\", \"parameters\": JSON Schema, \"readonly\": bool}]}. Inside the code read LAMP_TOOL and LAMP_ARGS (JSON) from env and print the result to stdout (a .syn needs `require env(\"LAMP_*\")`). Lamp names: letters, digits, - (no _).",
+let PLUGIN_SPEC be {
+    "name": "plugin",
+    "description": "Plugins are tools you can build for this project (they were called 'lamps' until 0.2.6; the user may still say lamp/lámpara): a folder with a plugin.json manifest plus code — a Synsema program (kind=syn) run under a capability ceiling, or any executable (kind=exec, any language, no ceiling). Consider one when a task needs a reusable custom tool (a project-specific query, generator, checker) that plain bash would repeat clumsily. action=list (default): every plugin found, on/off, its tools. action=create: write a PROJECT plugin (name + manifest + files) — it validates the manifest and runs `synsema check` on a syn entry, but does NOT run or enable it. action=enable / disable: turn one on or off — ALWAYS asks the user (enabling authorizes its code to run with the manifest's capabilities). An enabled plugin's tools appear in your catalog as plugin_<plugin>_<tool> from the NEXT turn. Manifest: {\"description\", \"kind\": \"syn\"|\"exec\", \"entry\": \"plugin.syn\" (syn) | \"command\": \"python plugin.py\" (exec), \"caps\": \"file.read=workspace/*\" (syn, optional extra ceiling over stdout,time,env=PLUGIN_*), \"timeout\": 60, \"tools\": [{\"name\", \"description\", \"parameters\": JSON Schema, \"readonly\": bool}]}. Inside the code read PLUGIN_TOOL and PLUGIN_ARGS (JSON) from env and print the result to stdout (a .syn needs `require env(\"PLUGIN_*\")`). Plugin names: letters, digits, - (no _). Not the same as a lamp from lamps.sh (a portable, ceiling-enforced capability unit for any MCP agent): those are installed with `lamp add` and reach you as MCP tools via `lamp mcp`.",
     "parameters": {"type": "object", "properties": {
         "action": {"type": "string", "enum": ["list", "create", "enable", "disable"], "description": "Default: list"},
-        "name": {"type": "string", "description": "create/enable/disable: lamp name"},
-        "manifest": {"type": "object", "description": "create only: the lamp.json content (name is filled in)"},
-        "files": {"type": "object", "description": "create only: {\"lamp.syn\": \"<code>\", …} — files written into the lamp folder", "additionalProperties": {"type": "string"}}
+        "name": {"type": "string", "description": "create/enable/disable: plugin name"},
+        "manifest": {"type": "object", "description": "create only: the plugin.json content (name is filled in)"},
+        "files": {"type": "object", "description": "create only: {\"plugin.syn\": \"<code>\", …} — files written into the plugin folder", "additionalProperties": {"type": "string"}}
     }, "required": ["action"]}
 }
 
@@ -158,8 +159,8 @@ let LSP_SPEC be {
 
 -- la tool schedule (lib/schedule.syn): tareas programadas. add/remove/enable/run piden humano SIEMPRE (permission.syn):
 -- crear una tarea = autorizar de una vez todo lo que va a hacer sin nadie mirando. Las corridas las hace el daemon
--- (web.syn); desde acá solo se corren en el acto las lamp/bash (una prompt anidaría un loop dentro del turno).
-task schedule_tool(action, id, name, at, kind, lamp, tool, args, command, prompt, agent, permission, approval_timeout, notify)
+-- (web.syn); desde acá solo se corren en el acto las plugin/bash (una prompt anidaría un loop dentro del turno).
+task schedule_tool(action, id, name, at, kind, plugin, tool, args, command, prompt, agent, permission, approval_timeout, notify)
     require exec
     require time
     require net
@@ -167,15 +168,15 @@ task schedule_tool(action, id, name, at, kind, lamp, tool, args, command, prompt
     require env("OS")
     require file(".lampson")
     require file(".lampson/*")
-    require file.read("lamps")
-    require file.read("lamps/*")
+    require file.read("plugins")
+    require file.read("plugins/*")
     require file("workspace")
     require file("workspace/*")
     let act be when action == nothing then "list" otherwise action
     when act == "add"
         let a be {"type": kind}
-        when kind == "lamp"
-            set a to {"type": "lamp", "lamp": lamp, "tool": tool, "args": when args == nothing then {} otherwise args}
+        when kind == "plugin"
+            set a to {"type": "plugin", "plugin": plugin, "tool": tool, "args": when args == nothing then {} otherwise args}
         otherwise when kind == "bash"
             set a to {"type": "bash", "command": command}
         otherwise when kind == "prompt"
@@ -227,16 +228,16 @@ task daemon_note()
 
 let SCHEDULE_SPEC be {
     "name": "schedule",
-    "description": "Scheduled tasks: run something on a schedule with nobody watching — a lamp tool, a fixed shell command, or a full agent run from a prompt (kind=prompt: the agent works unattended with the chosen profile and writes a report; its session appears as ⏰ <name>). `at` formats — recurring: 'every 6h' | 'every 30m' | 'daily 09:00' | 'mon,wed 08:30' | 'weekdays 09:00'; ONE-TIME (runs once, then turns itself off): 'today 15:14' | 'tomorrow 09:00' | 'once 2026-08-29 15:14' | 'in 2h'. Times are the USER'S LOCAL time (the machine's timezone): write the hour exactly as the user says it — NEVER convert to UTC. Tasks belong to the current workspace. permission = what a prompt run may do without asking: strict (dangerous actions denied), ask (default: a dangerous action sends the user an approval link/notification and waits up to approval_timeout seconds, denied if unanswered), yolo (allowed). notify = optional webhook URL that receives the result as JSON (for 'search and send me' tasks). action=add ALWAYS asks the user (it authorizes future unattended runs); remove/enable/disable/run also ask; list and log do not. The tasks are executed by Lampson's resident process (`lampson --daemon start` or the open web UI) — say so if the list shows no scheduler running. Use it when the user says 'every day at', 'each N hours', 'on Mondays', 'periodically', 'remind me', 'send me'.",
+    "description": "Scheduled tasks: run something on a schedule with nobody watching — a plugin tool, a fixed shell command, or a full agent run from a prompt (kind=prompt: the agent works unattended with the chosen profile and writes a report; its session appears as ⏰ <name>). `at` formats — recurring: 'every 6h' | 'every 30m' | 'daily 09:00' | 'mon,wed 08:30' | 'weekdays 09:00'; ONE-TIME (runs once, then turns itself off): 'today 15:14' | 'tomorrow 09:00' | 'once 2026-08-29 15:14' | 'in 2h'. Times are the USER'S LOCAL time (the machine's timezone): write the hour exactly as the user says it — NEVER convert to UTC. Tasks belong to the current workspace. permission = what a prompt run may do without asking: strict (dangerous actions denied), ask (default: a dangerous action sends the user an approval link/notification and waits up to approval_timeout seconds, denied if unanswered), yolo (allowed). notify = optional webhook URL that receives the result as JSON (for 'search and send me' tasks). action=add ALWAYS asks the user (it authorizes future unattended runs); remove/enable/disable/run also ask; list and log do not. The tasks are executed by Lampson's resident process (`lampson --daemon start` or the open web UI) — say so if the list shows no scheduler running. Use it when the user says 'every day at', 'each N hours', 'on Mondays', 'periodically', 'remind me', 'send me'.",
     "parameters": {"type": "object", "properties": {
         "action": {"type": "string", "enum": ["list", "add", "remove", "enable", "disable", "run", "log"], "description": "Default: list"},
         "id": {"type": "string", "description": "remove/enable/disable/run/log: the task id (from list)"},
         "name": {"type": "string", "description": "add: short human name"},
         "at": {"type": "string", "description": "add: the schedule — 'every 6h' | 'daily 09:00' | 'mon,wed 08:30' | 'weekdays 09:00'"},
-        "kind": {"type": "string", "enum": ["lamp", "bash", "prompt"], "description": "add: what runs"},
-        "lamp": {"type": "string", "description": "add kind=lamp: lamp name (must be ON)"},
-        "tool": {"type": "string", "description": "add kind=lamp: tool of that lamp"},
-        "args": {"type": "object", "description": "add kind=lamp: arguments for the tool"},
+        "kind": {"type": "string", "enum": ["plugin", "bash", "prompt"], "description": "add: what runs"},
+        "plugin": {"type": "string", "description": "add kind=plugin: plugin name (must be ON)"},
+        "tool": {"type": "string", "description": "add kind=plugin: tool of that plugin"},
+        "args": {"type": "object", "description": "add kind=plugin: arguments for the tool"},
         "command": {"type": "string", "description": "add kind=bash: the shell command (must finish on its own; no servers)"},
         "prompt": {"type": "string", "description": "add kind=prompt: self-contained instructions for the unattended agent run (what to do, how to verify, what to report)"},
         "agent": {"type": "string", "enum": ["build", "plan", "review", "explore"], "description": "add kind=prompt: profile (default build)"},
@@ -256,17 +257,18 @@ export task registry()
         "find": t_find.tool,
         "grep": t_grep.tool,
         "bash": t_bash.tool,
+        "fetch": t_fetch.tool,
         "process": t_process.tool,
         "memory": t_memo.tool,
         "todo": t_todo.tool,
         "skill": skill_tool,
         "mcp": mcp_tool,
-        "lamp": lamp_tool,
+        "plugin": plugin_tool,
         "lsp": lsp_tool,
         "schedule": schedule_tool
     }
 
-export let CATALOG be [t_read.SPEC, t_write.SPEC, t_edit.SPEC, t_ls.SPEC, t_find.SPEC, t_grep.SPEC, LSP_SPEC, t_bash.SPEC, t_process.SPEC, t_memo.SPEC, t_todo.SPEC, t_skill.SPEC, MCP_SPEC, LAMP_SPEC, SCHEDULE_SPEC]
+export let CATALOG be [t_read.SPEC, t_write.SPEC, t_edit.SPEC, t_ls.SPEC, t_find.SPEC, t_grep.SPEC, LSP_SPEC, t_fetch.SPEC, t_bash.SPEC, t_process.SPEC, t_memo.SPEC, t_todo.SPEC, t_skill.SPEC, MCP_SPEC, PLUGIN_SPEC, SCHEDULE_SPEC]
 
 -- Subconjuntos (para perfiles de agente): registry/catálogo filtrados por nombre.
 export task registry_subset(names)

package/lib/workspaces.syn

@@ -3,7 +3,7 @@
 -- Por qué así (ver ../SPEC-WORKSPACES.md): en Synsema las capabilities de archivo Y los `use "./lib/…"` se resuelven
 -- relativos al CWD del proceso, y `proxy to` es estático (se evalúa al arrancar y anexa el path entero). Entonces:
 --   * cada workspace tiene su propio directorio  .lampson/ws/<slug>/  que ES el cwd de su proceso:
---       workspace → junction al proyecto        lib public skills lamps memory → junctions a la instalación
+--       workspace → junction al proyecto        lib public skills plugins memory → junctions a la instalación
 --       web.syn chat.syn → copias (refrescadas al arrancar)        .lampson/ → estado propio (sesiones, tareas…)
 --       .lampson/global → junction a <home>/.lampson (config.json con keys, mcp/lsp globales, skills-*)
 --     con eso `file("workspace/*")`, `use "./lib/x.syn"` y todo el código de siempre funcionan SIN cambios.
@@ -26,7 +26,7 @@ export let HUB_FILE be "hub.syn"
 export let HUB_TEMPLATE be "hub.tpl.syn"
 -- rango alto para no chocar con lo que usan las apps (3000, 5173, 8000, 8080-8090…): solo el hub queda en 8080
 let FIRST_PORT be 47101
-let LINKS be ["lib", "public", "skills", "lamps", "memory"]
+let LINKS be ["lib", "public", "skills", "plugins", "memory"]
 let COPIES be ["web.syn", "chat.syn"]
 
 task is_win()
@@ -182,6 +182,31 @@ task unlink(where_)
 task is_link_dir(p)
     give file_exists(p)
 
+-- crea una carpeta de la instalación (ruta absoluta: fuera del alcance de write_file, así que por exec)
+task ensure_dir(p)
+    when is_win()
+        -- argumentos separados, como mklink: una línea entera con comillas dentro de `cmd /c` se rompe al citarla.
+        -- mkdir de cmd crea los intermedios y falla (sin daño) si ya existe.
+        run("cmd", ["/c", "mkdir", replace_text(p, "/", "\\")], 10)
+    otherwise
+        run("mkdir", ["-p", p], 10)
+    give true
+
+-- un link a la instalación (lib, public, skills, plugins, memory): se crea si falta y se REHACE si quedó colgante.
+-- file_exists da false tanto si no hay nada como si el link apunta a un destino que no existe (npm no trae
+-- memory/ ni plugins/; un `ln -s` a una carpeta inexistente nace roto y después memory(write) muere con
+-- "No such file or directory" — visto en un VPS el 2026-09-02). Por eso: destino primero, link después, y si
+-- sigue sin resolverse es un error del workspace, no un silencio.
+export task ensure_link(where_, target)
+    when file_exists(where_)
+        give true
+    unlink(where_)
+    ensure_dir(target)
+    link(where_, target)
+    when not file_exists(where_)
+        raise("could not link " + where_ + " → " + target + " (the workspace needs it: memory, plugins and the code live there)")
+    give true
+
 -- crea/repara .lampson/ws/<slug>: junctions al proyecto y a la instalación, copias de los entries
 export task prepare(w)
     require exec
@@ -209,16 +234,14 @@ export task prepare(w)
         when not link(ws_link, w["path"])
             raise("could not link " + ws_link + " → " + w["path"])
     each n in LINKS
-        when not file_exists(d + "/" + n)
-            link(d + "/" + n, h + sep + n)
-    when not file_exists(d + "/.lampson/global")
-        link(d + "/.lampson/global", h + sep + ".lampson")
+        ensure_link(d + "/" + n, h + sep + n)
+    ensure_link(d + "/.lampson/global", h + sep + ".lampson")
     each f in COPIES
         write_file(d + "/" + f, read_file(f))
     give d
 
 -- estado guardado ANTES de los workspaces (en <home>/.lampson, separado por slug en cada registro): sesiones y trazas
--- del proyecto, sus tareas programadas y el encendido de lámparas se mueven a <ws>/.lampson la primera vez
+-- del proyecto, sus tareas programadas y el encendido de plugins se mueven a <ws>/.lampson la primera vez
 task migrate(w, d)
     let slug be w["slug"]
     let moved be 0
@@ -248,8 +271,10 @@ task migrate(w, d)
     recover err
         set moved to moved
     try
-        when file_exists(".lampson/lamps.json")
-            write_file(d + "/.lampson/lamps.json", read_file(".lampson/lamps.json"))
+        when file_exists(".lampson/plugins.json")
+            write_file(d + "/.lampson/plugins.json", read_file(".lampson/plugins.json"))
+        otherwise when file_exists(".lampson/lamps.json")
+            write_file(d + "/.lampson/plugins.json", read_file(".lampson/lamps.json"))
     recover err
         set moved to moved
     give moved

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "lampson",
-  "version": "0.2.6",
-  "description": "A coding agent written in Synsema: terminal + web, tools confined to the mounted project, lamps (your own tool plugins), LSP, MCP, sub-agents.",
+  "version": "0.2.8",
+  "description": "A coding agent written in Synsema: terminal + web, tools confined to the mounted project, plugins (your own tools, any language), LSP, MCP, sub-agents.",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -9,7 +9,15 @@
   },
   "homepage": "https://github.com/kitecosmic/lampson#readme",
   "bugs": "https://github.com/kitecosmic/lampson/issues",
-  "keywords": ["agent", "coding-agent", "synsema", "llm", "cli", "lsp", "mcp"],
+  "keywords": [
+    "agent",
+    "coding-agent",
+    "synsema",
+    "llm",
+    "cli",
+    "lsp",
+    "mcp"
+  ],
   "bin": {
     "lampson": "bin/lampson.js"
   },
@@ -18,7 +26,7 @@
     "lib/",
     "public/",
     "skills/",
-    "lamps/",
+    "plugins/",
     "chat.syn",
     "web.syn",
     "hub.tpl.syn",

package/{lamps/example-hello/lamp.json → plugins/example-hello/plugin.json}

@@ -1,8 +1,8 @@
 {
   "name": "example-hello",
-  "description": "Example lamp: a Synsema program run under a capability ceiling. Copy this folder to make your own.",
+  "description": "Example plugin: a Synsema program run under a capability ceiling. Copy this folder to make your own.",
   "kind": "syn",
-  "entry": "lamp.syn",
+  "entry": "plugin.syn",
   "caps": "",
   "timeout": 20,
   "tools": [

package/plugins/example-hello/plugin.syn

@@ -0,0 +1,19 @@
+-- plugins/example-hello/plugin.syn — el plugin de ejemplo
+--
+-- Lampson lo corre así por cada llamada: synsema run --cap-set stdout,time,env=PLUGIN_*,env=LAMP_* plugin.syn
+-- El techo (--cap-set) sale del manifiesto (plugin.json → "caps") que el humano aprobó al encenderlo;
+-- pedir más acá (p. ej. `require net`) falla con "above the host ceiling".
+-- Entrada por env: PLUGIN_TOOL (qué tool), PLUGIN_ARGS (sus args en JSON), PLUGIN_DIR, PLUGIN_WORKSPACE.
+-- Salida: lo que imprimas por stdout vuelve al modelo como resultado de la tool.
+intent: "example plugin for lampson: greet"
+
+require env("PLUGIN_*")
+
+let tool be env("PLUGIN_TOOL", "")
+let args be json_decode(env("PLUGIN_ARGS", "{}"))
+
+when tool == "greet"
+    let who be when contains(args, "who") then text(args["who"]) otherwise "world"
+    print("hello, " + who + "! (from the example-hello plugin, running under a capability ceiling)")
+otherwise
+    print("ERROR: unknown tool '" + tool + "'")

package/public/css/panel.css

@@ -1,6 +1,6 @@
 /* panel: EL componente modal de la app (js/panel.js). Un cascarón (overlay, cabecera, ✕/Esc/clic afuera) y
    tres layouts: browse (buscador + lista + detalle), tabs (pestañas con formularios) y form (un formulario).
-   Cada vista (sesiones, lámparas, configuración, programar…) solo aporta su contenido; nada de esto se repite. */
+   Cada vista (sesiones, plugins, configuración, programar…) solo aporta su contenido; nada de esto se repite. */
 .modal { position:fixed; inset:0; background:rgba(0,0,0,.45); display:flex; align-items:center; justify-content:center; z-index:50; }
 .panel { background:var(--paper); border:1px solid var(--rule-2); border-radius:var(--r); box-shadow:0 10px 30px rgba(0,0,0,.35); display:flex; flex-direction:column; min-height:0; max-height:92vh; }
 .panel.lg { width:min(1100px, 94vw); height:min(760px, 90vh); padding:14px 18px 12px; }
@@ -94,11 +94,11 @@
 .panel .dfoot .del.ask .yes { color:var(--rubric); cursor:pointer; font-weight:600; }
 .panel .dfoot .del.ask .no { cursor:pointer; }
 .panel .none { color:var(--ink-3); font:400 13px/1.6 var(--serif); max-width:520px; }
-/* switch encendido/apagado (lámparas) */
+/* switch encendido/apagado (plugins) */
 .panel label.sw { display:inline-flex; align-items:center; margin:0 0 0 auto; gap:6px; cursor:pointer; user-select:none; font:400 11.5px/1 var(--mono); text-transform:none; letter-spacing:0; color:var(--ink-3); }
 .panel label.sw input { flex:none; width:16px; height:16px; padding:0; margin:0; accent-color:var(--accent); }
 .panel label.sw.on { color:var(--accent); }
-/* formulario generado desde un JSON Schema (tools de una lámpara) */
+/* formulario generado desde un JSON Schema (tools de un plugin) */
 .panel .tool { border:1px solid var(--rule); border-radius:var(--r); padding:10px 12px; margin-bottom:10px; }
 .panel .tool .th { display:grid; grid-template-columns:auto 1fr auto; gap:8px 10px; align-items:baseline; }
 .panel .tool .th code { font-weight:600; color:var(--ink); }

package/public/css/sidebar.css

@@ -82,3 +82,24 @@
 /* puertos ocupados por lampson: visibles pero sin link ni ✕ */
 .p .port.own { color:var(--ink-3); font-weight:400; }
 .p.own .cm { color:var(--ink-3); }
+
+/* explorador de archivos: selección, portapapeles, arrastre, renombrar en línea y menú contextual */
+#tree:focus { outline:none; }
+.row.sel { background:var(--paper-2); }
+.row.cut { opacity:.55; }
+.row.dragging { opacity:.4; }
+.row.drop, #tree.drop { background:var(--accent-bg); border-left-color:var(--accent); }
+.row.flash { background:var(--accent-bg); transition:background .7s; }
+.row input.rn { flex:1; min-width:0; font:inherit; color:var(--ink); background:var(--paper-2); border:1px solid var(--accent); border-radius:var(--r); padding:0 4px; outline:none; }
+.row.new { color:var(--ink); }
+.ctx { position:fixed; z-index:70; min-width:220px; background:var(--paper); border:1px solid var(--rule-2); border-radius:var(--r); box-shadow:0 10px 30px rgba(0,0,0,.35); padding:4px 0; font:400 12.5px/1.5 var(--mono); user-select:none; }
+.ctx .it { display:flex; align-items:center; gap:14px; padding:4px 12px; cursor:pointer; color:var(--ink-2); white-space:nowrap; }
+.ctx .it:hover { background:var(--paper-2); color:var(--ink); }
+.ctx .it .k { margin-left:auto; color:var(--ink-3); font-size:10.5px; }
+.ctx .it.dis { opacity:.4; pointer-events:none; }
+.ctx .it.danger:hover { color:var(--rubric); }
+.ctx .it.ask { color:var(--ink-2); gap:6px; }
+.ctx .it.ask .yes { color:var(--rubric); font-weight:600; cursor:pointer; }
+.ctx .it.ask .no { cursor:pointer; }
+.ctx .it.ask .yes:hover, .ctx .it.ask .no:hover { text-decoration:underline; text-underline-offset:.18em; }
+.ctx .sep { height:1px; background:var(--rule); margin:4px 0; }

package/public/hub.html

@@ -25,7 +25,7 @@
     <div class="empty">
       <p class="eyebrow">workspaces</p>
       <h1>¿En qué proyecto trabajamos?</h1>
-      <p class="lead">Cada workspace es una carpeta de tu disco con su propio agente: sesiones, tareas programadas, lámparas, MCP. Corren en procesos separados, así podés tener varios abiertos a la vez. Los que tienen tareas encendidas siguen vivos aunque cierres todo.</p>
+      <p class="lead">Cada workspace es una carpeta de tu disco con su propio agente: sesiones, tareas programadas, plugins, MCP. Corren en procesos separados, así podés tener varios abiertos a la vez. Los que tienen tareas encendidas siguen vivos aunque cierres todo.</p>
       <div class="wsgrid" id="wsGrid"></div>
       <p class="lead" style="margin-top:22px">Desde una terminal: <code>cd mi-proyecto &amp;&amp; lampson</code> (terminal) o <code>lampson --web</code> (esta web, en ese workspace).</p>
     </div>

package/public/index.html

@@ -33,7 +33,7 @@
     <select id="agent" title="perfil de agente: qué tools puede usar"></select>
     <select id="perm" title="qué pasa con un comando peligroso (rm -rf, git push --force, sudo…)"><option value="ask">permisos: preguntar</option><option value="yolo">permisos: permitir todo</option><option value="strict">permisos: denegar</option></select>
     <span class="pill on" id="wsPill" style="display:none" title="cambiar de workspace">workspace ▾</span>
-    <span class="pill" id="lamps" title="lámparas: plugins de tools que vos encendés · clic para ver y activar">lámparas</span>
+    <span class="pill" id="plugins" title="plugins: tools propias que vos encendés · clic para ver y activar">plugins</span>
     <span class="pill" id="model" title="proveedor y modelo · clic para cambiarlos o cargar una API key">…</span>
   </div>
 </header>
@@ -77,7 +77,7 @@
     <div class="body" id="apprBox"></div>
   </section>
   <section class="sec" data-sec="sched">
-    <h2 title="tareas programadas (cada 6 h, todos los días a las 9, lunes 8:30…): una lámpara, un comando o una corrida del agente. Corren mientras lampson esté abierto, o con lampson --daemon start"><span class="caret">▸</span>Programadas<span class="cnt" id="schedCount"></span><button class="h2act" id="schedAddBtn" title="programar una tarea">+</button></h2>
+    <h2 title="tareas programadas (cada 6 h, todos los días a las 9, lunes 8:30…): un plugin, un comando o una corrida del agente. Corren mientras lampson esté abierto, o con lampson --daemon start"><span class="caret">▸</span>Programadas<span class="cnt" id="schedCount"></span><button class="h2act" id="schedAddBtn" title="programar una tarea">+</button></h2>
     <div class="body" id="schedBox"></div>
   </section>
 </aside>
@@ -119,7 +119,7 @@
 <script src="/js/todo.js"></script>
 <script src="/js/mcp.js"></script>
 <script src="/js/lsp.js"></script>
-<script src="/js/lamps.js"></script>
+<script src="/js/plugins.js"></script>
 <script src="/js/schedules.js"></script>
 <script src="/js/approvals.js"></script>
 <script src="/js/config.js"></script>

package/public/js/app.js

@@ -14,7 +14,7 @@ async function loadCfg() {
   sel.onchange = () => { localStorage.setItem('lampson.agent', sel.value); hint(); }; hint();
   if (!log.children.length) empty();
 }
-loadCfg().then(() => { loadTree(); loadSessions(); loadProcs(); loadMemory(); loadAgents(); loadMcp(); loadLsp(); loadLamps(); loadTodo(); loadSched(); loadApprovals(); checkUpdate(); const pq = new URLSearchParams(location.search).get('proc'); if (pq) openProc(pq); else if (session) openSession(session); });
+loadCfg().then(() => { loadTree(); loadSessions(); loadProcs(); loadMemory(); loadAgents(); loadMcp(); loadLsp(); loadPlugins(); loadTodo(); loadSched(); loadApprovals(); checkUpdate(); const pq = new URLSearchParams(location.search).get('proc'); if (pq) openProc(pq); else if (session) openSession(session); });
 // respaldos lentos por si el stream de eventos se cae
 setInterval(loadProcs, events ? 60000 : 10000);
 setInterval(() => { loadSched(); if (!events) loadApprovals(); }, events ? 60000 : 15000);