lampson 0.2.7 → 0.2.9

package/lib/git.syn

@@ -21,12 +21,12 @@ export task status()
     let branch be ""
     let changes be {}
     let counts be {"modified": 0, "added": 0, "deleted": 0, "untracked": 0}
-    each line in split(replace_text(out, "\r", ""), "\n")
+    each line in split(replace(out, "\r", ""), "\n")
         when starts_with(line, "## ")
             set branch to split(split(slice(line, 3, length(line)), "...")[0], " ")[0]
         otherwise when length(line) > 3
             let xy be slice(line, 0, 2)
-            let path be replace_text(trim(slice(line, 3, length(line))), "\"", "")
+            let path be replace(trim(slice(line, 3, length(line))), "\"", "")
             when contains(path, " -> ")
                 set path to split(path, " -> ")[1]
             let code be trim(xy)

package/lib/judge.syn

@@ -0,0 +1,78 @@
+-- lib/judge.syn — el juez de decisión de Lampson: un modelo System One que contesta preguntas tipadas con
+-- probabilidades (el bloque `judge` de Synsema: whether / choose / rate), no con texto
+--
+-- Es una credencial/configuración de Lampson, como el proveedor del LLM — no de una tool. Hoy lo usan:
+--   * computer_use: la acción `act` (elige el próximo control de una lista cerrada) y page_select (elige la opción
+--     de un desplegable cuando el texto no coincide) — lib/computer.syn + lib/computer_judge.syn
+-- y cualquier parte de Lampson que necesite una decisión calibrada y barata puede usarlo con `require judge` y
+-- judge.on() como compuerta (clasificar, rutear, validar, decidir si algo aplica…).
+--
+-- Backends (se elige en ⚙ → Juez de decisión, /judge en la terminal):
+--   jev   TypeSafe Jev, en la nube: rápido (~0,3 s por decisión), multilingüe, necesita API key (keys.typesafe)
+--   laya  Laya local (ModernBERT, ~840 MB en disco): sin red ni costo, ~1-2 s por decisión en CPU; medido
+--         2026-09-28: con interfaces en español el checkpoint `english` se equivoca con confianza alta
+--   off   sin juez
+-- El runtime lee el proveedor del ENTORNO al arrancar el proceso (settings.judge_env): cambiarlo reinicia el
+-- workspace (web) o pide salir y volver a entrar (terminal).
+
+use "./settings.syn" as settings
+
+export let MODES be ["off", "jev", "laya"]
+
+export task norm_mode(v)
+    let t be lower(trim(text(when v == nothing then "" otherwise v)))
+    when t == "jev" or t == "typesafe"
+        give "jev"
+    when t == "laya" or t == "local"
+        give "laya"
+    give "off"
+
+-- el modo configurado (config.json / .env), esté vivo o no en este proceso
+export task mode()
+    require file.read(".lampson")
+    require file.read(".lampson/*")
+    require env("LAMPSON_*")
+    give norm_mode(settings.judge_setting()["mode"])
+
+-- encendido en la configuración Y con un proveedor vivo en este proceso: la compuerta de quien lo use
+export task on()
+    require file.read(".lampson")
+    require file.read(".lampson/*")
+    require env("LAMPSON_*")
+    when mode() == "off"
+        give false
+    give judge_available()
+
+-- {mode, model_setting, has_key, live, provider_model, restart, from_env}: lo que ven la UI y /judge
+export task status()
+    require file.read(".lampson")
+    require file.read(".lampson/*")
+    require env("LAMPSON_*")
+    let js be settings.judge_setting()
+    let m be norm_mode(js["mode"])
+    let live be judge_available()
+    let pm be judge_model()
+    -- el proceso corre otro proveedor que el configurado (o ninguno): hace falta reiniciar
+    let restart be false
+    when m != "off" and not live
+        set restart to true
+    when m == "laya" and pm != nothing and not starts_with(text(pm), "laya:")
+        set restart to true
+    when m == "jev" and pm != nothing and starts_with(text(pm), "laya:")
+        set restart to true
+    give {"mode": m, "model_setting": text(js["model"]), "has_key": settings.raw_key("typesafe") != "", "live": live, "provider_model": when pm == nothing then "" otherwise text(pm), "restart": restart, "from_env": js["from_env"]}
+
+-- guardar el modo (y opcionalmente el modelo / la key de TypeSafe) → {ok, error}
+export task configure(m, model, key)
+    require file(".lampson")
+    require file(".lampson/*")
+    require env("LAMPSON_*")
+    let nm be lower(trim(text(m)))
+    when not contains(MODES, nm) and nm != "typesafe" and nm != "local"
+        give {"ok": false, "error": "judge: off, jev or laya"}
+    set nm to norm_mode(nm)
+    when key != nothing
+        when trim(text(key)) != ""
+            settings.set_key("typesafe", trim(text(key)))
+    settings.set_judge(nm, model)
+    give {"ok": true, "error": nothing}

package/lib/line.syn

@@ -37,7 +37,7 @@ task starts(s, p)
 task candidates(buf, ctx)
     when not starts(buf, "/") or contains(buf, "\n")
         give {"kind": "", "items": [], "token": ""}
-    let sp be capture(buf, "^(/\S*)\s+(.*)$")
+    let sp be regex_capture(buf, "^(/\S*)\s+(.*)$")
     when sp == nothing
         -- comando a medias: recientes primero cuando es "/" pelado
         let items be []
@@ -208,7 +208,7 @@ export task read(prompt, color, ctx)
             set result to nothing
             set done to true
         otherwise when ev["type"] == "paste"
-            set st to insert(st, replace_text(ev["text"], "\r", ""))
+            set st to insert(st, replace(ev["text"], "\r", ""))
             set st to refresh_menu(st, ctx)
         otherwise when ev["type"] == "resize"
             ui.set_cols(ev["cols"])

package/lib/loop.syn

@@ -27,6 +27,23 @@ use "./plugins.syn" as plugins
 use "./tools/todo.syn" as todo
 
 let MAX_ERRORS_PER_TURN be 8
+-- capturas de computer_use (lib/computer.syn): el driver las deja en el blackboard "computer:screenshot" y acá van al
+-- modelo como imagen adjunta a un mensaje de usuario (un tool result es texto en todos los proveedores). Solo la más
+-- reciente viaja con la imagen; las anteriores quedan como nota (≈1500 tokens cada una, en CADA request).
+let SHOT_PREFIX be "[harness] Screenshot from computer_use: "
+
+export task drop_old_screenshots(msgs)
+    let out be []
+    each m in msgs
+        let is_shot be false
+        when m["role"] == "user"
+            when contains(m, "images")
+                set is_shot to starts_with(text(m["content"]), SHOT_PREFIX)
+        when is_shot
+            set out to append(out, {"role": "user", "content": text(m["content"]) + " [image removed to save context]"})
+        otherwise
+            set out to append(out, m)
+    give out
 -- Conciencia de progreso (2026-08-28, la mejor idea de cada harness — ver notes/*.md):
 --   * SPILL (deepseek): un resultado > SPILL_CAP se guarda entero en .lampson/spill/<call>.txt y el modelo ve
 --     cabeza + cola + "Full result saved to …"; `read` queda exento (ya pagina con offset/limit).
@@ -47,7 +64,7 @@ let REPEAT_HARD be 8
 -- seguidas sin ninguna acción (edit/write/bash/process/delegate/mcp). Visto 2026-08-28 con deepseek-v4-pro:
 -- 39 read/ls/find seguidos, 0 ediciones, 419k tokens, dos veces, con las reglas de prompt ignoradas.
 -- A la mitad del tope el resultado lleva un aviso; al tope, read/ls/find/grep se rechazan hasta que actúe.
-let READ_ONLY_TOOLS be ["read", "ls", "find", "grep"]
+let READ_ONLY_TOOLS be ["read", "ls", "find", "grep", "fetch"]
 let ACTION_TOOLS be ["edit", "write", "bash", "process", "delegate"]
 
 export task explore_cap()
@@ -67,7 +84,7 @@ export task explore_verdict(streak, name, cap)
     when n >= cap
         give {"streak": n, "note": "", "refuse": true}
     when n == floor(cap / 2)
-        give {"streak": n, "note": "\n\n[harness] " + text(n) + " read-only calls in a row without changing anything. You likely know enough: edit/write now, or run the relevant command. After " + text(cap) + " read-only calls in a row, read/ls/find/grep are refused until you act. If the codebase is genuinely too big, delegate ONE focused question to an `explore` sub-agent instead of reading everything yourself.", "refuse": false}
+        give {"streak": n, "note": "\n\n[harness] " + text(n) + " read-only calls in a row without changing anything. You likely know enough: edit/write now, or run the relevant command. After " + text(cap) + " read-only calls in a row, read/ls/find/grep/fetch are refused until you act. If the codebase is genuinely too big, delegate ONE focused question to an `explore` sub-agent instead of reading everything yourself.", "refuse": false}
     give {"streak": n, "note": "", "refuse": false}
 
 -- JSON canónico (claves ordenadas en profundidad): reordenar propiedades no engaña al detector
@@ -98,7 +115,8 @@ task safe_id(id, step)
 export task spill(name, id, out)
     require file(".lampson")
     require file(".lampson/*")
-    when name == "read" or length(out) <= SPILL_CAP
+    -- read y fetch se recortan solas (fetch: cabeza+cola con el texto completo ya en .lampson/spill)
+    when name == "read" or name == "fetch" or length(out) <= SPILL_CAP
         give out
     -- el informe de los subagentes es el entregable: no se manda a disco (hasta 60k)
     when name == "delegate" and length(out) <= SPILL_CAP * 6
@@ -106,7 +124,7 @@ export task spill(name, id, out)
     let path be SPILL_DIR + "/" + id + ".txt"
     write_file(path, out)
     let half be floor(SPILL_CAP / 2)
-    give slice(out, 0, half) + "\n\n[... " + text(length(out) - SPILL_CAP) + " chars omitted. Full result saved to " + path + " — grep it, or read it with offset/limit; do not re-run the command ...]\n\n" + slice(out, length(out) - half, length(out))
+    give slice(out, 0, half) + "\n\n[... " + text(length(out) - SPILL_CAP) + " chars omitted. Full result saved to " + path + " — use the grep or read TOOLS on that exact path (it lives in lampson, outside your workspace: bash cannot see it); do not re-run the command ...]\n\n" + slice(out, length(out) - half, length(out))
 
 -- recibo de una línea para un tool result viejo
 export task receipt(m)
@@ -115,13 +133,13 @@ export task receipt(m)
         give out
     let status be "ok"
     when starts_with(out, "ERROR") or starts_with(out, "DENIED")
-        set status to slice(replace_text(split(out, "\n")[0], "\r", ""), 0, 120)
+        set status to slice(replace(split(out, "\n")[0], "\r", ""), 0, 120)
     otherwise
-        let codes be find_all(out, "\\[exit code [0-9]+\\]")
+        let codes be regex_find_all(out, "\\[exit code [0-9]+\\]")
         when length(codes) > 0
             let last be codes[length(codes) - 1]
             set status to slice(last, 1, length(last) - 1)
-    let saved be find_all(out, "Full result saved to [^ ]+")
+    let saved be regex_find_all(out, "Full result saved to [^ ]+")
     let where_full be when length(saved) > 0 then " · " + saved[0] otherwise ""
     give "[" + text(m["name"]) + " result pruned: " + status + " · " + text(length(split(out, "\n"))) + " lines/" + text(length(out)) + " chars" + where_full + " — re-run the tool only if you really need the content again]"
 
@@ -323,6 +341,8 @@ export task run_turn(cfg, messages, opts, on_event)
     let max_steps be opts["max_steps"]
     let budget be opts["budget_tokens"]
     let tag be opts["tag"]
+    -- ¿este modelo acepta imágenes? lo leen las tools que producen capturas (computer_use) para avisar al modelo
+    share provider.supports_vision(cfg) as "lampson:vision"
     -- compaction preventiva
     when estimate_tokens(msgs) > opts["compact_at_tokens"]
         emit(on_event, "compact", {"before": estimate_tokens(msgs)}, tag)
@@ -375,6 +395,11 @@ export task run_turn(cfg, messages, opts, on_event)
         emit(on_event, "usage", {"step": steps, "usage": r["usage"], "total": usage}, tag)
         let clean_text be strip_raw_tool_calls(r["text"])
         let assistant be {"role": "assistant", "content": clean_text, "tool_calls": r["tool_calls"]}
+        -- razonamiento del paso (solo lo trae el wire para los presets glm): va en el mensaje para
+        -- devolvérselo al modelo en el paso siguiente (thinking conservado, ver provider.chat_openai)
+        when contains(r, "reasoning")
+            when r["reasoning"] != ""
+                set assistant["reasoning"] to r["reasoning"]
         set msgs to append(msgs, assistant)
         when clean_text != ""
             emit(on_event, "assistant", clean_text, tag)
@@ -394,7 +419,7 @@ export task run_turn(cfg, messages, opts, on_event)
                 set out to "ERROR: you already called " + tc["name"] + " with these exact arguments " + text(repeats) + " times in a row. The result will not change; try a different approach or report the problem."
                 emit(on_event, "tool_denied", {"call": tc, "reason": "repeated call (" + text(repeats) + "x)"}, tag)
             otherwise when ex["refuse"]
-                set out to "ERROR: exploration cap reached — " + text(explore_streak) + " read-only calls in a row (read/ls/find/grep) without a single change. Reading more will not help. Do one of: (1) edit/write the files you already read; (2) run a command (bash/process) that moves the task; (3) delegate ONE focused question to an `explore` sub-agent; (4) tell the user what you need. read/ls/find/grep are refused until you do."
+                set out to "ERROR: exploration cap reached — " + text(explore_streak) + " read-only calls in a row (read/ls/find/grep) without a single change. Reading more will not help. Do one of: (1) edit/write the files you already read; (2) run a command (bash/process) that moves the task; (3) delegate ONE focused question to an `explore` sub-agent; (4) tell the user what you need. read/ls/find/grep/fetch are refused until you do."
                 emit(on_event, "tool_denied", {"call": tc, "reason": "exploration cap (" + text(explore_streak) + " read-only calls without acting)"}, tag)
             otherwise when contains(READ_ONLY_TOOLS, tc["name"]) and reads_total >= turn_cap
                 set out to "ERROR: this turn already made " + text(reads_total) + " read-only calls (limit " + text(turn_cap) + "). Everything you read is in your context. Act on it now (edit/write/run), delegate ONE focused question to an `explore` sub-agent, or report to the user."
@@ -421,6 +446,14 @@ export task run_turn(cfg, messages, opts, on_event)
                 set errors to errors + 1
             emit(on_event, "tool_result", {"call": tc, "output": out}, tag)
             set msgs to append(msgs, tool_result_msg(tc, out))
+            -- captura de pantalla pendiente (computer_use): adjunta como imagen si el proveedor tiene visión
+            observe "computer:screenshot" as shot
+            when shot != nothing
+                share nothing as "computer:screenshot"
+                when provider.supports_vision(cfg)
+                    set msgs to drop_old_screenshots(msgs)
+                    set msgs to append(msgs, {"role": "user", "content": SHOT_PREFIX + shot["label"] + ". Look at it, then continue the task.", "images": shot["images"]})
+                    emit(on_event, "inbox", "captura de pantalla adjunta al modelo (" + shot["label"] + ")", tag)
         when errors >= MAX_ERRORS_PER_TURN
             set msgs to append(msgs, {"role": "user", "content": "[harness] Too many tool errors this turn. Stop calling tools and report what happened."})
             emit(on_event, "busy", {"label": "pensando", "kind": "llm"}, tag)

package/lib/lsp.syn

@@ -92,13 +92,13 @@ export task servers()
 -- resuelven realpaths, así que el rootUri y los uri de los documentos tienen que ser los reales.
 export task root_path()
     require env("LAMPSON_*")
-    let r be replace_text(env("LAMPSON_WORKSPACE", "workspace"), "\\", "/")
+    let r be replace(env("LAMPSON_WORKSPACE", "workspace"), "\\", "/")
     when c.ends_with(r, "/")
         set r to slice(r, 0, length(r) - 1)
     give r
 
 export task to_uri(path)
-    let p be replace_text(replace_text(path, "\\", "/"), " ", "%20")
+    let p be replace(replace(path, "\\", "/"), " ", "%20")
     when matches(p, "[A-Za-z]:/.*")
         give "file:///" + p
     give "file://" + p
@@ -109,7 +109,7 @@ export task from_uri(uri)
         set u to slice(u, 8, length(u))
     otherwise when starts_with(u, "file://")
         set u to slice(u, 7, length(u))
-    give replace_text(replace_text(replace_text(u, "%3A", ":"), "%3a", ":"), "%20", " ")
+    give replace(replace(replace(u, "%3A", ":"), "%3a", ":"), "%20", " ")
 
 -- uri del server → ruta relativa al workspace (o absoluta si cae fuera)
 export task relativize(uri, root)
@@ -123,7 +123,7 @@ export task relativize(uri, root)
     give p
 
 task ext_of(path)
-    let parts be split(replace_text(path, "\\", "/"), "/")
+    let parts be split(replace(path, "\\", "/"), "/")
     let base be parts[length(parts) - 1]
     let segs be split(base, ".")
     when length(segs) < 2

package/lib/mcp.syn

@@ -109,6 +109,24 @@ agent McpSup
         let sub be bus_subscribe(["mcp.req." + name, "mcp.stop." + name, "mcp.stop_all"])
         -- request síncrona (handshake y tools/list): manda y espera la respuesta con ese id, saltando
         -- notificaciones y basura; devuelve {result} | {error} | nothing (timeout / proceso muerto)
+        -- MIGA runtime (2026-09-06): proc_spawn en line_mode parte las líneas de más de 1 MiB en trozos de 1 MiB; un
+        -- resultado grande (una captura base64) llegaba en trozos que no decodificaban y la respuesta se perdía.
+        -- `acc` junta los trozos hasta que el JSON cierra; un trozo suelto que decodifica solo reinicia el acumulador.
+        let acc be ""
+        task decode_line(data)
+            let joined be acc + data
+            try
+                let m be json_decode(joined)
+                set acc to ""
+                give m
+            recover e1
+                try
+                    let m2 be json_decode(data)
+                    set acc to ""
+                    give m2
+                recover e2
+                    set acc to when length(joined) > 40000000 then "" otherwise joined
+                    give nothing
         task rpc(method, params, timeout)
             set seq to seq + 1
             let id be seq
@@ -122,12 +140,10 @@ agent McpSup
                 otherwise when ev["type"] == "exit"
                     set answer to {"error": "server exited with code " + text(ev["data"]["exit_code"])}
                 otherwise when ev["type"] == "stdout"
-                    try
-                        let m be json_decode(ev["data"])
+                    let m be decode_line(ev["data"])
+                    when m != nothing
                         when contains(m, "id") and m["id"] == id
                             set answer to when contains(m, "error") then {"error": text(m["error"]["message"])} otherwise {"result": m["result"]}
-                    recover e2
-                        set answer to answer
             give answer
         task notify(method, params)
             proc_send(p, json_encode({"jsonrpc": "2.0", "method": method, "params": params}) + "\n")

package/lib/md.syn

@@ -21,9 +21,9 @@ task width_now()
 task paths(s, color)
     when not color
         give s
-    let out be replace_re(s, "(^|[\s(])([\w.-]*/[\w./-]{2,})", "\1" + ESC + "[34m\2" + ESC + "[0m")
-    set out to replace_re(out, "(^|[\s(])(\w+\.(syn|js|ts|tsx|jsx|json|md|py|rs|go|ps1|sh|html|css|toml|yml|yaml|env))(\b)", "\1" + ESC + "[34m\2" + ESC + "[0m")
-    set out to replace_re(out, "(^|[\s(])(\w+\(\))", "\1" + ESC + "[34m\2" + ESC + "[0m")
+    let out be regex_replace(s, "(^|[\s(])([\w.-]*/[\w./-]{2,})", "\1" + ESC + "[34m\2" + ESC + "[0m")
+    set out to regex_replace(out, "(^|[\s(])(\w+\.(syn|js|ts|tsx|jsx|json|md|py|rs|go|ps1|sh|html|css|toml|yml|yaml|env))(\b)", "\1" + ESC + "[34m\2" + ESC + "[0m")
+    set out to regex_replace(out, "(^|[\s(])(\w+\(\))", "\1" + ESC + "[34m\2" + ESC + "[0m")
     give out
 
 task sgr(color, code, s)
@@ -42,16 +42,16 @@ task rep(ch, n)
 task emphasis(s, color)
     let out be s
     -- links [texto](url) → texto url  (antes que la cursiva: la url puede traer _ o *)
-    set out to replace_re(out, "\[([^\]]+)\]\(([^)]+)\)", sgr(color, "4", "\1") + sgr(color, "2", " \2"))
-    set out to replace_re(out, "\*\*([^*]+)\*\*", sgr(color, "1", "\1"))
-    set out to replace_re(out, "__([^_]+)__", sgr(color, "1", "\1"))
-    set out to replace_re(out, "~~([^~]+)~~", sgr(color, "9", "\1"))
+    set out to regex_replace(out, "\[([^\]]+)\]\(([^)]+)\)", sgr(color, "4", "\1") + sgr(color, "2", " \2"))
+    set out to regex_replace(out, "\*\*([^*]+)\*\*", sgr(color, "1", "\1"))
+    set out to regex_replace(out, "__([^_]+)__", sgr(color, "1", "\1"))
+    set out to regex_replace(out, "~~([^~]+)~~", sgr(color, "9", "\1"))
     -- cursiva: *x* solo si no está pegada a texto/número (2*3 no es cursiva). Dos pasadas:
     -- el grupo \3 consume el separador, así que "*a* *b*" necesita la segunda.
     let pass be 0
     while pass < 2
-        set out to replace_re(out, "(^|[^\w*])\*([^*\s][^*]*?)\*($|[^\w*])", "\1" + sgr(color, "3", "\2") + "\3")
-        set out to replace_re(out, "(^|[^\w_])_([^_\s][^_]*?)_($|[^\w_])", "\1" + sgr(color, "3", "\2") + "\3")
+        set out to regex_replace(out, "(^|[^\w*])\*([^*\s][^*]*?)\*($|[^\w*])", "\1" + sgr(color, "3", "\2") + "\3")
+        set out to regex_replace(out, "(^|[^\w_])_([^_\s][^_]*?)_($|[^\w_])", "\1" + sgr(color, "3", "\2") + "\3")
         set pass to pass + 1
     give out
 
@@ -162,8 +162,8 @@ export task render(md, color)
     let table be []
     each line in split(md, "\n")
         let t be trim(line)
-        let heading be capture(t, "^(#{1,6}) (.+)$")
-        let item be capture(t, "^(\d{1,3})[.)] (.*)$")
+        let heading be regex_capture(t, "^(#{1,6}) (.+)$")
+        let item be regex_capture(t, "^(\d{1,3})[.)] (.*)$")
         let is_row be starts_with(t, "|") and ends_with(t, "|") and not in_code
         when length(table) > 0 and not is_row
             each l in table_lines(table, pre, color)

package/lib/origin.syn

@@ -0,0 +1,67 @@
+-- lib/origin.syn — de dónde viene una petición HTTP: la usan el hub (hub.tpl.syn, lib/auth.syn) y cada workspace (web.syn).
+--
+-- «Local» (esta PC, entra sin passkey) se PRUEBA con las tres cosas a la vez, nunca se deduce de lo que falta:
+--   1. el peer es loopback;
+--   2. no pasó por ningún proxy (sin X-Forwarded-*, Forwarded ni los headers de cloudflared);
+--   3. el Host CRUDO es un nombre de loopback. Un túnel (syn tunnel, cloudflared, ngrok) o el edge de --domain
+--      traen el Host público; una página con DNS rebinding trae el suyo.
+-- Desde el motor v0.6.42 los X-Forwarded-* de un peer que no está en `trust proxy` se borran antes del programa. El
+-- hub y los workspaces confían en loopback (`trust proxy` / `--trust-proxy`): ahí conectan los túneles, el edge y el
+-- proxy del hub, así que lo que dicen llega y `ip of request` es el cliente real. Sin eso, un syn tunnel entraba
+-- como «esta PC» (2026-10-05). Un túnel TCP crudo (ssh -R, ngrok tcp) no deja rastro y no se puede distinguir:
+-- nunca se apunta uno al hub.
+--
+-- Otra origin en el navegador — CSRF, un WebSocket abierto desde otra página, DNS rebinding — se rechaza siempre,
+-- local o remoto: un navegador manda Origin en todo POST, en todo WebSocket y en los fetch entre origins, y tiene
+-- que coincidir con la origin de la propia petición. Sin Origin (curl, scripts, navegación) no hay sitio ajeno.
+-- Módulo puro: sin require.
+
+let FORWARD_HEADERS be ["x-forwarded-for", "x-forwarded-host", "x-forwarded-proto", "forwarded", "x-real-ip", "cf-connecting-ip", "cf-ray"]
+let LOOPBACK_NAMES be ["localhost", "127.0.0.1", "::1"]
+
+export task is_loopback(ip)
+    give ip == "127.0.0.1" or ip == "::1" or ip == "::ffff:127.0.0.1"
+
+-- valor de Host (o X-Forwarded-Host) → nombre sin puerto ni corchetes, en minúsculas
+export task host_name(value)
+    let h be trim(split(lower(text(value)), ",")[0])
+    when starts_with(h, "[")
+        give split(slice(h, 1, length(h)), "]")[0]
+    give split(h, ":")[0]
+
+-- "host[:puerto]" como lo vio el navegador: el que puso el proxy de confianza, o el Host si no hubo proxy
+task authority(headers)
+    give trim(split(lower(text(get(headers, "x-forwarded-host", get(headers, "host", "")))), ",")[0])
+
+-- el Host que llegó a ESTE servidor (un proxy lo reescribe al suyo; el de afuera queda en X-Forwarded-Host)
+export task raw_host(headers)
+    give host_name(get(headers, "host", ""))
+
+-- el dominio que ve el usuario: rp_id de WebAuthn
+export task public_host(headers)
+    give host_name(authority(headers))
+
+-- la origin que ve el navegador. Lampson no termina TLS en el hub ni en los workspaces: sin un proxy de confianza
+-- que diga https (el edge, un túnel), es http
+export task origin_of(headers)
+    let proto be lower(trim(split(text(get(headers, "x-forwarded-proto", "")), ",")[0]))
+    when proto == ""
+        set proto to "http"
+    give proto + "://" + authority(headers)
+
+export task forwarded(headers)
+    each h in FORWARD_HEADERS
+        when contains(headers, h)
+            give true
+    give false
+
+export task loopback_host(headers)
+    give contains(LOOPBACK_NAMES, raw_host(headers))
+
+export task cross_site(headers)
+    when not contains(headers, "origin")
+        give false
+    give lower(trim(text(headers["origin"]))) != origin_of(headers)
+
+export task is_local(ip, headers)
+    give is_loopback(ip) and not forwarded(headers) and loopback_host(headers)

package/lib/permission.syn

@@ -9,6 +9,9 @@
 --
 -- Modos (LAMPSON_PERMISSION): "ask" (default) | "yolo" (dangerous → allow) | "strict" (dangerous → deny)
 
+use "./tools/url.syn" as u
+use "./computer.syn" as computer
+
 -- Tier 1: nunca. Coincidencia por substring, case-insensitive.
 -- (el comando se evalúa con un espacio final añadido, así "rm -rf / " matchea la raíz pero NO "rm -rf /tmp/x")
 export let HARDLINE be [
@@ -69,9 +72,30 @@ export task evaluate(name, args, mode)
                 give {"decision": "deny", "reason": "strict mode (dangerous: " + danger + ")"}
             give {"decision": "ask", "reason": "dangerous pattern: " + danger}
         give {"decision": "allow", "reason": "command"}
+    when name == "fetch"
+        -- política de hosts de url.syn (hermes url_safety): secretos en la URL y metadata de la nube se
+        -- deniegan SIEMPRE (incluso en yolo); hosts privados/loopback (el dev server del usuario) piden;
+        -- lo público se permite. Una URL inválida se permite: la tool devuelve el error explicado.
+        let furl be when contains(args, "url") then text(args["url"]) otherwise ""
+        let why be u.sensitive(furl)
+        when why != nothing
+            give {"decision": "deny", "reason": "the URL carries " + why + " — secrets never travel in URLs"}
+        let fp be u.parse(furl)
+        when not fp["ok"]
+            give {"decision": "allow", "reason": "invalid URL (the tool explains)"}
+        let cls be u.host_class(fp["host"])
+        when cls == "blocked"
+            give {"decision": "deny", "reason": "cloud metadata endpoint " + fp["host"]}
+        when cls == "private"
+            when mode == "yolo"
+                give {"decision": "allow", "reason": "yolo mode (private host " + fp["host"] + ")"}
+            when mode == "strict"
+                give {"decision": "deny", "reason": "strict mode (private host " + fp["host"] + ")"}
+            give {"decision": "ask", "reason": "fetches a private/loopback host (" + fp["origin"] + ")"}
+        give {"decision": "allow", "reason": "public URL"}
     when name == "write" or name == "edit"
         -- el scope file("./*") ya impide salir del workspace; aquí solo miramos secretos obvios
-        let p be when contains(args, "path") then lower(replace_text(text(args["path"]), "\\", "/")) otherwise ""
+        let p be when contains(args, "path") then lower(replace(text(args["path"]), "\\", "/")) otherwise ""
         let parts be split(p, "/")
         let base be parts[length(parts) - 1]
         when is_secret_env(base)
@@ -130,11 +154,27 @@ export task evaluate(name, args, mode)
         when mode == "strict"
             give {"decision": "deny", "reason": "strict mode (installs a third-party skill)"}
         give {"decision": "ask", "reason": "installs a third-party skill from " + (when contains(args, "source") then text(args["source"]) otherwise "?") + " (" + (when contains(args, "scope") then text(args["scope"]) otherwise "global") + ")"}
+    when name == "computer_use"
+        -- el escritorio del usuario (lib/computer.syn): leer (ventanas, árbol, capturas, texto) siempre; actuar pide UNA
+        -- sola vez por corrida — la primera acción — y cubre todo lo demás (teclas en foreground, abrir apps y
+        -- navegadores): pedir por cada cosa hacía inútil la tool (2026-09-06: cuatro pedidos para llenar un form).
+        -- La tool deja "computer:grant" en el blackboard al ejecutar la primera aprobada. strict deniega actuar.
+        let cact be when contains(args, "action") then lower(text(args["action"])) otherwise ""
+        when not contains(computer.ACTING, cact)
+            give {"decision": "allow", "reason": "read-only tool"}
+        when mode == "yolo"
+            give {"decision": "allow", "reason": "yolo mode (computer " + cact + ")"}
+        when mode == "strict"
+            give {"decision": "deny", "reason": "strict mode (computer " + cact + ")"}
+        observe "computer:grant" as granted
+        when granted == true
+            give {"decision": "allow", "reason": "desktop control granted this run"}
+        give {"decision": "ask", "reason": "takes control of your desktop for the rest of this run — clicks and keys in the background (briefly to the front when an app needs it), opening apps and browser windows; asked once"}
     give {"decision": "allow", "reason": "read-only tool"}
 
 -- Resumen legible de una tool call, para mostrar al humano antes de aprobar / en el log.
 task one_line(s, max)
-    let t be replace_text(replace_text(s, "\r", ""), "\n", " ⏎ ")
+    let t be replace(replace(s, "\r", ""), "\n", " ⏎ ")
     when length(t) > max
         give slice(t, 0, max) + "…"
     give t
@@ -142,6 +182,8 @@ task one_line(s, max)
 export task describe_call(name, args)
     when starts_with(name, "mcp_") or starts_with(name, "plugin_")
         give name + " " + one_line(json_encode(args), 160)
+    when name == "computer_use"
+        give computer.describe(args)
     when name == "lsp" and contains(args, "op") and text(args["op"]) == "add"
         give "lsp add " + (when contains(args, "server") then text(args["server"]) otherwise "?") + " (" + (when contains(args, "scope") then text(args["scope"]) otherwise "global") + ")"
     when name == "lsp"
@@ -167,6 +209,9 @@ export task describe_call(name, args)
         give "skill install " + text(args["source"]) + " --skill " + text(args["name"]) + " (" + (when contains(args, "scope") then text(args["scope"]) otherwise "global") + ")"
     when name == "bash"
         give "$ " + one_line(when contains(args, "command") then text(args["command"]) otherwise "", 160)
+    when name == "fetch"
+        let ffmt be arg(args, "format", "markdown")
+        give "fetch " + one_line(arg(args, "url", "?"), 140) + (when ffmt != "markdown" then " (" + ffmt + ")" otherwise "")
     -- lectura/búsqueda: como lo escribiría un humano en la shell
     when name == "read"
         let rng be when contains(args, "offset") or contains(args, "limit") then "  (" + (when contains(args, "offset") then "desde " + text(floor(number(text(args["offset"])))) otherwise "") + (when contains(args, "limit") then " " + text(floor(number(text(args["limit"])))) + " líneas" otherwise "") + ")" otherwise ""

package/lib/prompt.syn

@@ -6,6 +6,7 @@
 
 use "./skills.syn" as skills
 use "./tools/memo.syn" as memo
+use "./computer.syn" as computer
 
 let CONTEXT_FILES be ["AGENTS.md", "LAMPSON.md"]
 
@@ -22,13 +23,20 @@ task read_context_files()
     give out
 
 export task build(env_info, addendum)
+    require exec
+    require time
     require file.read("workspace")
     require file.read("workspace/*")
     require file.read("skills")
     require file.read("skills/*")
     require file.read("memory")
     require file.read("memory/*")
+    require file.read(".lampson")
+    require file.read(".lampson/*")
     require env("LAMPSON_*")
+    require env("OS")
+    -- computer_use solo se menciona cuando está en el catálogo (encendida + driver): vacío si no
+    let cu be computer.prompt_line()
     let core be `You are Lampson, a coding agent that works inside the user's project through tools.
 Operate like a careful senior engineer: precise, honest, and economical with words.
 
@@ -53,13 +61,14 @@ Operate like a careful senior engineer: precise, honest, and economical with wor
 
 # Tools
 - read (offset/limit), ls, find (glob), grep (regex): use them instead of bash with cat/ls/find/grep — line-numbered and cheaper. lsp (symbols/definition/references/hover): the file's structure without reading it, and exact navigation when grep is ambiguous — prefer lsp symbols plus a ranged read over reading a big file whole. edit: targeted replacement. write: create or fully replace.
+- fetch (url, format, max_chars): web pages and HTTP APIs as Markdown — docs, READMEs, issues, changelogs, JSON. Use it instead of bash with curl/wget for anything you will read: it asks the site for Markdown first and strips scripts, styles and navigation, so a page costs a tenth of its HTML. A long page comes back head+tail with the full text saved to a file: read (offset/limit) or grep that file, never fetch the same URL again. Cite the URL when you use its content. Use bash+curl only for POST, custom headers or downloads.
 - bash: shell commands from the workspace root. State does not persist between calls (cd resets) — chain with &&. Check the [exit code: N] marker on every result (it is the last line) and investigate failures before moving on. Never pipe a build or test through head/tail: the output is already truncated for you (the full text is saved to a file whose path you get) and the pipe hides the real exit code. Never run a server or watcher here.
 - process: start/logs/stop long-running commands (dev servers, watchers). Their new log lines arrive automatically with every later tool result — do not sleep or poll. Stop what you started when the task is done.
 - delegate: sub-agents with a fresh context (explore, plan, review, worker); several tasks in one call run in parallel, background=true returns at once and the report arrives later as a message. Give a highly detailed, self-contained brief, say whether it should write code or only research, how to verify, and exactly what to return. Its report is a self-report — verify what matters before telling the user it is done. Its output is not visible to the user: summarise it.
 - memory: durable facts across sessions (user preferences, environment details, tool quirks, conventions). Check it before investigating. Write declarative facts, not instructions to yourself; do not store task progress or anything stale in a week. The notes live outside the project: only this tool reaches them (never ls/bash, never files inside the repo).
 - skill: before starting a kind of task, scan the skill list below; if one matches or is even partially relevant, load it and follow it. Err on the side of loading.
 - todo: your task list (whole-list replacement, one in_progress at a time; see Method step 1).
-- MCP tools are named mcp_<server>_<tool>; calling one may ask the user for approval. The mcp tool lists, connects (action=add, with the user's approval) and disconnects servers; a new server's tools enter your catalog on the next turn.
+- MCP tools are named mcp_<server>_<tool>; calling one may ask the user for approval. The mcp tool lists, connects (action=add, with the user's approval) and disconnects servers; a new server's tools enter your catalog on the next turn.{cu}
 - Call several independent tools in one turn (reads, searches, read-only commands); serialize only when a later call depends on an earlier result. Tool outputs are truncated at 30k chars — narrow your queries.
 
 # Tone