lampson 0.2.8 → 0.2.10

package/lib/workspaces.syn

@@ -7,7 +7,7 @@
 --       web.syn chat.syn → copias (refrescadas al arrancar)        .lampson/ → estado propio (sesiones, tareas…)
 --       .lampson/global → junction a <home>/.lampson (config.json con keys, mcp/lsp globales, skills-*)
 --     con eso `file("workspace/*")`, `use "./lib/x.syn"` y todo el código de siempre funcionan SIN cambios.
---   * cada workspace corre `synsema serve web.syn --port 808N --bind 127.0.0.1` DESACOPLADO del hub (start /b,
+--   * cada workspace corre `synsema serve web.syn --port 471NN --bind 127.0.0.1` DESACOPLADO del hub (start /b,
 --     process_group:false): sobrevive a reinicios del hub y a cerrar terminales. Solo loopback.
 --   * el hub (hub.syn, :8080) se GENERA desde hub.tpl.syn con una ruta proxy por workspace y corre con
 --     `synsema serve hub.syn` desacoplado: al registrar/quitar un workspace se reescribe y un helper lo reinicia.
@@ -18,6 +18,7 @@
 use "./tools/bash.syn" as t_bash
 use "./tools/proc.syn" as proc
 use "./settings.syn" as settings
+use "./auth.syn" as auth
 
 export let ROOT be ".lampson/ws"
 export let REGISTRY be ".lampson/workspaces.json"
@@ -47,11 +48,11 @@ export task home()
     let r be sh("pwd -W 2>/dev/null || pwd -P", 10)
     let p be trim(text(r["stdout"]))
     when is_win()
-        give replace_text(p, "/", "\\")
+        give replace(p, "/", "\\")
     give p
 
 export task norm(p)
-    let s be lower(replace_text(trim(text(p)), "\\", "/"))
+    let s be lower(replace(trim(text(p)), "\\", "/"))
     when matches(s, "/[a-z]/.*")
         set s to slice(s, 1, 2) + ":" + slice(s, 2, length(s))
     while length(s) > 1 and slice(s, length(s) - 1, length(s)) == "/"
@@ -64,7 +65,7 @@ export task slug_of(path)
     let n be norm(path)
     let parts be where(split(n, "/"), (x) => x != "")
     let base be when length(parts) > 0 then parts[length(parts) - 1] otherwise "workspace"
-    let runs be find_all(base, "[a-z0-9]+")
+    let runs be regex_find_all(base, "[a-z0-9]+")
     let clean be when length(runs) == 0 then "project" otherwise join(runs, "-")
     give clean + "-" + slice(decode(sha256(n), "hex"), 0, 8)
 
@@ -102,10 +103,7 @@ export task migrate_ports()
     each k in keys(doc["workspaces"])
         let w be doc["workspaces"][k]
         when w["port"] < FIRST_PORT
-            let old be w["port"]
-            each l in proc.listeners()
-                when l["port"] == old
-                    proc.kill_pid(l["pid"])
+            kill_ports([w["port"]])
             set w["port"] to doc["next_port"]
             set doc["next_port"] to doc["next_port"] + 1
             set doc["workspaces"][k] to w
@@ -167,14 +165,14 @@ export task dir_of(slug)
 
 task link(where_, target)
     when is_win()
-        let r be run("cmd", ["/c", "mklink", "/J", replace_text(where_, "/", "\\"), replace_text(target, "/", "\\")], 15)
+        let r be run("cmd", ["/c", "mklink", "/J", replace(where_, "/", "\\"), replace(target, "/", "\\")], 15)
         give r["exit_code"] == 0
     let r be run("ln", ["-s", target, where_], 10)
     give r["exit_code"] == 0
 
 task unlink(where_)
     when is_win()
-        run("cmd", ["/c", "rmdir", replace_text(where_, "/", "\\")], 10)
+        run("cmd", ["/c", "rmdir", replace(where_, "/", "\\")], 10)
     otherwise
         run("rm", ["-f", where_], 10)
     give true
@@ -187,7 +185,7 @@ task ensure_dir(p)
     when is_win()
         -- argumentos separados, como mklink: una línea entera con comillas dentro de `cmd /c` se rompe al citarla.
         -- mkdir de cmd crea los intermedios y falla (sin daño) si ya existe.
-        run("cmd", ["/c", "mkdir", replace_text(p, "/", "\\")], 10)
+        run("cmd", ["/c", "mkdir", replace(p, "/", "\\")], 10)
     otherwise
         run("mkdir", ["-p", p], 10)
     give true
@@ -254,7 +252,7 @@ task migrate(w, d)
                 recover err
                     set doc to nothing
                 when doc != nothing and contains(doc, "meta") and contains(doc["meta"], "project") and doc["meta"]["project"] == slug
-                    let id be replace_text(e["name"], ".json", "")
+                    let id be replace(e["name"], ".json", "")
                     sh("mkdir -p '" + d + "/.lampson/sessions' '" + d + "/.lampson/trace' && mv -f '.lampson/sessions/" + e["name"] + "' '" + d + "/.lampson/sessions/' && mv -f .lampson/trace/" + id + ".* '" + d + "/.lampson/trace/' 2>/dev/null; true", 20)
                     set moved to moved + 1
     recover err
@@ -313,7 +311,7 @@ export task ensure(path)
             let port be doc["next_port"]
             set doc["next_port"] to port + 1
             save_reg(doc)
-            let parts be where(split(replace_text(text(path), "\\", "/"), "/"), (x) => x != "")
+            let parts be where(split(replace(text(path), "\\", "/"), "/"), (x) => x != "")
             set w to {"slug": slug, "name": parts[length(parts) - 1], "path": text(path), "port": port, "policy": "auto", "created": now(), "last_used": now()}
         put(w)
         when regen_hub() and hub_alive()
@@ -350,8 +348,10 @@ export task remove(slug)
 task hub_routes(w)
     let base be "http://127.0.0.1:" + text(w["port"])
     let lines be []
+    -- el API pide auth en el hub: el proceso del workspace ve 127.0.0.1 y confía en todo lo que le llega.
+    -- Los links de aprobación no: llevan su propio token de un solo uso.
     each m in ["GET", "POST"]
-        set lines to append(lines, "    route \"" + m + " /w/" + w["slug"] + "/api/*path\"\n        proxy to \"" + base + "\"")
+        set lines to append(lines, "    route \"" + m + " /w/" + w["slug"] + "/api/*path\" requires auth\n        proxy to \"" + base + "\"")
     set lines to append(lines, "    route \"GET /w/" + w["slug"] + "/approve/*path\"\n        proxy to \"" + base + "\"")
     give join(lines, "\n")
 
@@ -365,7 +365,10 @@ export task regen_hub()
     let blocks be []
     each w in all()
         set blocks to append(blocks, hub_routes(w))
-    let body be replace_text(tpl, "    -- @workspaces", when length(blocks) == 0 then "    -- (sin workspaces registrados todavía)" otherwise join(blocks, "\n"))
+    let body be replace(tpl, "    -- @workspaces", when length(blocks) == 0 then "    -- (sin workspaces registrados todavía)" otherwise join(blocks, "\n"))
+    -- con dominio propio, de afuera se entra SOLO por el edge (:443, TLS): el hub deja de escuchar en la red
+    when domain_cfg() != nothing
+        set body to replace(body, "    -- @bind", "    bind \"127.0.0.1\"   -- dominio activo (lampson --domain): de afuera se entra por el edge HTTPS")
     let cur be ""
     try
         set cur to read_file(HUB_FILE)
@@ -384,8 +387,8 @@ task spawn_detached(cwd, cmdline, envs)
     when is_win()
         -- WorkingDirectory absoluto: el relativo se resolvería contra el cwd del PowerShell (que ya es `cwd`)
         let h be home()
-        let abs be when cwd == "." then h otherwise h + "\\" + replace_text(cwd, "/", "\\")
-        let ps be "Start-Process -FilePath cmd -ArgumentList '/c', '" + replace_text(cmdline, "'", "''") + "' -WorkingDirectory '" + replace_text(abs, "'", "''") + "' -WindowStyle Hidden"
+        let abs be when cwd == "." then h otherwise h + "\\" + replace(cwd, "/", "\\")
+        let ps be "Start-Process -FilePath cmd -ArgumentList '/c', '" + replace(cmdline, "'", "''") + "' -WorkingDirectory '" + replace(abs, "'", "''") + "' -WindowStyle Hidden"
         let p be proc_spawn("powershell", ["-NoProfile", "-NonInteractive", "-Command", ps], {"cwd": cwd, "env": envs, "process_group": false})
         proc_wait(p, 15)
         proc_close(p)
@@ -414,6 +417,10 @@ export task start_ws(w)
     let sep be when is_win() then "\\" otherwise "/"
     let envf be h + sep + ".env"
     let envs be {"LAMPSON_WS": w["slug"], "LAMPSON_WORKSPACE": w["path"], "LAMPSON_PORT": text(w["port"]), "LAMPSON_HOME": h}
+    -- el juez de computer use (⚙ → Computer use): el runtime lo lee del entorno al arrancar — por eso aplica al reiniciar
+    let je be settings.judge_env()
+    each k in keys(je)
+        set envs[k] to je[k]
     let exe be env("LAMPSON_SYNSEMA", "synsema")
     -- el .env de la instalación (cwd = home; la capability es relativa, la ruta que se pasa al hijo es absoluta)
     let cmd be exe + " serve web.syn --port " + text(w["port"]) + " --bind 127.0.0.1" + (when file_exists(".env") then " --env-file \"" + envf + "\"" otherwise "") + " > .lampson/web.log 2>&1"
@@ -470,16 +477,30 @@ export task pause_ws(w)
     summary()
     give true
 
-export task stop_ws(w)
+-- matar lo que escucha en estos puertos: UNA consulta de puertos (proc.port_owners) para todos → cuántos mató
+export task kill_ports(ports)
     require exec
-    require time
     require env("LAMPSON_*")
     require env("OS")
-    require net("127.0.0.1")
-    let victims be where(proc.listeners(), (l) => l["port"] == w["port"])
-    each l in victims
-        proc.kill_pid(l["pid"])
-    give length(victims) > 0
+    let n be 0
+    let done be {}
+    each l in proc.port_owners()
+        when contains(ports, l["port"]) and not contains(done, text(l["pid"]))
+            set done[text(l["pid"])] to true
+            proc.kill_pid(l["pid"])
+            set n to n + 1
+    give n
+
+export task stop_ws(w)
+    give kill_ports([w["port"]]) > 0
+
+-- Lampson entero (lampson --hub stop, ⚙ → Apagar o reiniciar): workspaces y hub en una sola pasada, y el edge
+export task stop_all()
+    let ports be [HUB_PORT]
+    each w in all()
+        set ports to append(ports, w["port"])
+    stop_edge()
+    give kill_ports(ports)
 
 -- ---------- hub ----------
 export task hub_alive()
@@ -508,15 +529,34 @@ export task start_hub()
     spawn_detached(".", exe + " serve " + HUB_FILE + " > .lampson/hub.log 2>&1", {"LAMPSON_HOME": home()})
     give true
 
--- hub.syn cambió (workspace nuevo/quitado): un helper DESACOPLADO (cli.syn hub-restart) para el hub y lo vuelve a
--- arrancar — puede llamarse desde el propio hub (que va a morir en el medio) o desde cli.syn
+-- un comando de cli.syn en un helper DESACOPLADO: para lo que el propio hub pide y en el medio lo mata a él
+-- (reiniciarse, apagar Lampson entero). Log en .lampson/<cmd>.log
+export task cli_later(cmd)
+    require exec
+    require time
+    require env("LAMPSON_*")
+    require env("OS")
+    let exe be env("LAMPSON_SYNSEMA", "synsema")
+    spawn_detached(".", exe + " run cli.syn > .lampson/" + cmd + ".log 2>&1", {"LAMPSON_HOME": home(), "LAMPSON_CMD": cmd, "LAMPSON_DETACHED": "1"})
+    give true
+
+-- hub.syn cambió (workspace nuevo/quitado): cli.syn hub-restart para el hub y lo vuelve a arrancar (los workspaces
+-- siguen) — puede llamarse desde el propio hub o desde cli.syn
 export task restart_hub_later()
+    give cli_later("hub-restart")
+
+-- reiniciar UN workspace desde adentro (su propio proceso va a morir en el medio): un helper desacoplado
+-- (cli.syn ws-restart) lo para y lo vuelve a arrancar con el entorno nuevo — el juez de computer use se lee al
+-- arrancar el proceso (settings.judge_env), así que cambiarlo en ⚙ necesita esto (2026-09-28)
+export task restart_ws_later(slug)
     require exec
     require time
     require env("LAMPSON_*")
     require env("OS")
     let exe be env("LAMPSON_SYNSEMA", "synsema")
-    spawn_detached(".", exe + " run cli.syn > .lampson/hub-restart.log 2>&1", {"LAMPSON_HOME": home(), "LAMPSON_CMD": "hub-restart"})
+    -- cwd = la instalación: en Windows spawn_detached resuelve "." contra home(); en unix hay que dársela absoluta
+    let cwd be when is_win() then "." otherwise home()
+    spawn_detached(cwd, exe + " run cli.syn > .lampson/ws-restart.log 2>&1", {"LAMPSON_HOME": home(), "LAMPSON_CMD": "ws-restart", "LAMPSON_WS": slug})
     give true
 
 export task stop_hub()
@@ -524,10 +564,135 @@ export task stop_hub()
     require time
     require env("LAMPSON_*")
     require env("OS")
-    let victims be where(proc.listeners(), (l) => l["port"] == HUB_PORT)
-    each l in victims
-        proc.kill_pid(l["pid"])
-    give length(victims) > 0
+    give kill_ports([HUB_PORT]) > 0
+
+-- ---------- dominio propio (opcional): edge HTTPS en :443 ----------
+-- `lampson --domain lampson.midominio.com --email yo@midominio.com` guarda .lampson/domain.json; desde ahí el
+-- supervisor mantiene vivo edge.syn (TLS de Let's Encrypt) y el hub pasa a escuchar solo en 127.0.0.1.
+-- `lampson --domain off` lo quita y todo vuelve a ser como antes. Sin dominio, nada de esto corre.
+export let EDGE_FILE be "edge.syn"
+let DOMAIN_FILE be ".lampson/domain.json"
+-- tras un arranque fallido no reintentar enseguida: Let's Encrypt limita las validaciones fallidas por hora
+let EDGE_RETRY_S be 600
+
+task edge_port()
+    give int(env("LAMPSON_EDGE_PORT", "443"))
+
+export task domain_cfg()
+    require file.read(".lampson")
+    require file.read(".lampson/*")
+    try
+        when file_exists(DOMAIN_FILE)
+            let d be json_decode(read_file(DOMAIN_FILE))
+            -- ojo: este módulo define su propia task `get(slug)`, que tapa el builtin get(mapa, clave, default)
+            when type_of(d) == "map" and contains(d, "domain") and text(d["domain"]) != ""
+                give d
+    recover err
+        give nothing
+    give nothing
+
+export task valid_domain(d)
+    give matches(d, "[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)+") and not matches(d, "[0-9.]+")
+
+-- guarda el dominio; el email (contacto de Let's Encrypt) se pide la primera vez y después se recuerda
+export task set_domain(domain, email)
+    require file(".lampson")
+    require file(".lampson/*")
+    require env("LAMPSON_*")
+    let d be lower(trim(text(domain)))
+    set d to regex_replace(d, "^https?://", "")
+    set d to regex_replace(d, "/.*$", "")
+    when not valid_domain(d)
+        raise "«" + text(domain) + "» no parece un dominio (ej.: lampson.midominio.com)"
+    let prev be domain_cfg()
+    let em be trim(text(email))
+    when em == "" and prev != nothing
+        set em to when contains(prev, "email") then text(prev["email"]) otherwise ""
+    when not contains(em, "@")
+        raise "falta el email para Let's Encrypt (avisos de vencimiento del certificado): --email vos@dominio.com"
+    write_file(DOMAIN_FILE, json_encode({"domain": d, "email": em, "since": now()}))
+    -- el QR de emparejamiento apunta al dominio
+    auth.set_public_url("https://" + d)
+    give {"domain": d, "email": em}
+
+export task clear_domain()
+    require file(".lampson")
+    require file(".lampson/*")
+    require env("LAMPSON_*")
+    let prev be domain_cfg()
+    write_file(DOMAIN_FILE, "{}")
+    when prev != nothing and auth.public_url() == "https://" + prev["domain"]
+        auth.set_public_url("")
+    give prev != nothing
+
+export task edge_alive()
+    require exec
+    require time
+    require env("OS")
+    give length(edge_pids()) > 0
+
+export task start_edge()
+    require exec
+    require time
+    require env("LAMPSON_*")
+    require env("OS")
+    require file(".lampson")
+    require file(".lampson/*")
+    let cfg be domain_cfg()
+    when cfg == nothing
+        give false
+    write_file(".lampson/edge.last", text(now()))
+    let exe be env("LAMPSON_SYNSEMA", "synsema")
+    let cmd be exe + " serve " + EDGE_FILE + " --port " + text(edge_port()) + " --domain " + cfg["domain"] + " --tls-auto " + cfg["email"] + " > .lampson/edge.log 2>&1"
+    spawn_detached(".", cmd, {"LAMPSON_HOME": home()})
+    give true
+
+-- el edge escucha en :443, un puerto que en un VPS puede ser de otro (nginx, caddy): se reconoce por su línea de
+-- comando, no solo por el puerto
+task edge_pids()
+    let out be []
+    each l in proc.port_owners()
+        when l["port"] == edge_port() and contains(proc.command_of(l["pid"]), EDGE_FILE)
+            set out to append(out, l["pid"])
+    give out
+
+export task stop_edge()
+    require exec
+    require time
+    require env("OS")
+    let pids be edge_pids()
+    each pid in pids
+        proc.kill_pid(pid)
+    give length(pids) > 0
+
+-- lo llama el tick: dominio configurado + edge caído → levantarlo (con espera tras un intento fallido)
+export task keep_edge()
+    require exec
+    require time
+    require env("LAMPSON_*")
+    require env("OS")
+    require file(".lampson")
+    require file(".lampson/*")
+    when domain_cfg() == nothing or edge_alive()
+        give false
+    let last be 0
+    try
+        set last to number(read_file(".lampson/edge.last"))
+    recover err
+        set last to 0
+    when now() - last < EDGE_RETRY_S
+        give false
+    give start_edge()
+
+-- últimas líneas del log del edge (para diagnosticar desde la CLI)
+export task edge_log(n)
+    require file.read(".lampson")
+    require file.read(".lampson/*")
+    try
+        let lines be where(split(replace(read_file(".lampson/edge.log"), "\r", ""), "\n"), (l) => trim(l) != "")
+        give slice(lines, max(0, length(lines) - n), length(lines))
+    recover err
+        give []
 
 -- ---------- política y supervisor (tick del hub) ----------
 export task idle_hours()
@@ -587,6 +752,7 @@ export task tick()
     require file.read("chat.syn")
     when migrate_ports() and hub_alive()
         restart_hub_later()
+    keep_edge()
     let started be []
     let stopped be []
     let list be all()
@@ -669,14 +835,14 @@ export task browse(path)
     require env("LAMPSON_*")
     require env("OS")
     let p be when path == nothing or trim(text(path)) == "" then env("HOME", env("USERPROFILE", "/")) otherwise text(path)
-    let r be sh("cd \"" + replace_text(p, "\"", "") + "\" 2>/dev/null && (pwd -W 2>/dev/null || pwd -P) && ls -1 -d -- */ 2>/dev/null", 10)
-    let lines be where(split(replace_text(text(r["stdout"]), "\r", ""), "\n"), (x) => trim(x) != "")
+    let r be sh("cd \"" + replace(p, "\"", "") + "\" 2>/dev/null && (pwd -W 2>/dev/null || pwd -P) && ls -1 -d -- */ 2>/dev/null", 10)
+    let lines be where(split(replace(text(r["stdout"]), "\r", ""), "\n"), (x) => trim(x) != "")
     when length(lines) == 0
         give {"path": p, "dirs": [], "error": "no existe o no se puede leer"}
     let here be lines[0]
     when is_win()
-        set here to replace_text(here, "/", "\\")
-    let dirs be apply(slice(lines, 1, length(lines)), (d) => replace_text(d, "/", ""))
-    let parts be where(split(replace_text(here, "\\", "/"), "/"), (x) => x != "")
+        set here to replace(here, "/", "\\")
+    let dirs be apply(slice(lines, 1, length(lines)), (d) => replace(d, "/", ""))
+    let parts be where(split(replace(here, "\\", "/"), "/"), (x) => x != "")
     let parent be when length(parts) > 1 then join(slice(parts, 0, length(parts) - 1), when is_win() then "\\" otherwise "/") otherwise (when is_win() then parts[0] + "\\" otherwise "/")
     give {"path": here, "parent": parent, "dirs": where(dirs, (d) => not starts_with(d, "."))}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lampson",
-  "version": "0.2.8",
+  "version": "0.2.10",
   "description": "A coding agent written in Synsema: terminal + web, tools confined to the mounted project, plugins (your own tools, any language), LSP, MCP, sub-agents.",
   "license": "MIT",
   "repository": {
@@ -30,6 +30,7 @@
     "chat.syn",
     "web.syn",
     "hub.tpl.syn",
+    "edge.syn",
     "cli.syn",
     "lampson.ps1",
     "lampson.sh",
@@ -42,7 +43,7 @@
     "node": ">=18"
   },
   "dependencies": {
-    "synsema": "^0.6.11"
+    "synsema": "^0.6.42"
   },
   "scripts": {
     "test": "pwsh -NoProfile -File tests/run.ps1"

package/public/css/code.css

@@ -0,0 +1,48 @@
+/* code: el editor de archivos del visor y el tema de highlight.js (archivos abiertos y bloques ``` del chat) */
+
+/* ---- editor: textarea transparente sobre el <pre> resaltado; el gutter aparte sigue el scroll (js/editor.js) ---- */
+#viewer.edit { height:100%; display:flex; flex-direction:column; }
+#viewer.edit .vh { flex:none; }
+#editor { flex:1; min-height:0; position:relative; overflow:hidden; background:var(--paper); }
+#editor[hidden] { display:none; }
+/* la misma métrica que #viewer pre (layout.css): 12.5px/1.62 mono, padding 14px 18px, números en 4ch + 16px */
+#egut { position:absolute; left:0; top:0; width:calc(18px + 4ch + 16px); padding:14px 0 14px 18px; font:400 12.5px/1.62 var(--mono); color:var(--ink-3); text-align:right; user-select:none; pointer-events:none; will-change:transform; }
+#egut span { display:block; padding-right:16px; }
+#viewer #ehl, #viewer #eta { position:absolute; inset:0; margin:0; padding:14px 18px 14px calc(18px + 4ch + 16px); font:400 12.5px/1.62 var(--mono); tab-size:4; white-space:pre; overflow-wrap:normal; word-break:normal; letter-spacing:normal; }
+#viewer #ehl { overflow:hidden; pointer-events:none; color:var(--ink); }
+#viewer #ehl code { display:block; font:inherit; white-space:pre; min-height:100%; min-width:max-content; }
+/* min/max-height:none pisan el textarea genérico del composer (layout.css: max-height 220px) */
+#viewer #eta { display:block; width:100%; height:100%; min-height:0; max-height:none; border:0; outline:0; resize:none; background:transparent; color:transparent; -webkit-text-fill-color:transparent; caret-color:var(--ink); overflow:auto; }
+#viewer #eta::selection { background:var(--sel); color:transparent; }
+#viewer #eta[readonly] { caret-color:transparent; cursor:default; }
+/* cabecera del visor en modo editor: lenguaje · líneas · estado; el botón guardar solo si hay algo que guardar */
+.vh .dirty { color:var(--amber); font-weight:600; }
+.vh .note { color:var(--str); }
+.vh .warn { color:var(--amber); }
+.vh .err { color:var(--rubric); }
+.vh a { color:var(--accent); text-decoration:none; border-bottom:1px dashed var(--rule-2); }
+.vh a:hover { color:var(--ink); border-bottom-color:var(--ink-3); }
+.vh #vsave { padding:4px 9px; font-size:9.5px; letter-spacing:.08em; }
+.vh #vsave:disabled { opacity:.4; }
+.vh .x.ask { color:var(--ink); }
+.vh .x.ask .yes { color:var(--rubric); cursor:pointer; font-weight:600; }
+.vh .x.ask .no { cursor:pointer; }
+
+/* ---- highlight.js: la paleta se raciona como en el resto de la UI — azul lo estructural (keywords, tags), verde
+   strings, ámbar números/literales/builtins/atributos, rubric rojo lo que abre permisos en Synsema (require,
+   allow, deny…), gris los comentarios. Funciona en dark y light porque todo son tokens. ---- */
+.hljs { color:var(--ink); background:transparent; }
+.hljs-comment, .hljs-quote, .hljs-meta, .hljs-meta .hljs-keyword, .hljs-meta .hljs-string { color:var(--ink-3); font-style:italic; }
+.hljs-keyword, .hljs-selector-tag, .hljs-tag, .hljs-name, .hljs-doctag, .hljs-section, .hljs-template-tag { color:var(--accent); }
+.hljs-string, .hljs-regexp, .hljs-addition, .hljs-char.escape_, .hljs-symbol, .hljs-bullet, .hljs-link { color:var(--str); }
+.hljs-number, .hljs-literal, .hljs-built_in, .hljs-type, .hljs-attr, .hljs-attribute, .hljs-selector-class, .hljs-selector-id, .hljs-selector-attr, .hljs-selector-pseudo, .hljs-variable, .hljs-template-variable, .hljs-variable.language_, .hljs-property { color:var(--amber); }
+.hljs-title, .hljs-title.function_, .hljs-title.class_, .hljs-title.class_.inherited__, .hljs-title.function_.invoke__ { color:var(--ink); font-weight:600; }
+.hljs-deletion { color:var(--rubric); }
+.hljs-keyword.security_ { color:var(--rubric); }
+.hljs-subst { color:var(--ink); font-weight:400; }
+.hljs-punctuation, .hljs-operator { color:var(--ink-2); }
+.hljs-emphasis { font-style:italic; }
+.hljs-strong { font-weight:600; }
+/* xml/html: el nombre del tag azul, sus atributos ámbar, los valores verdes */
+.hljs-tag .hljs-attr { color:var(--amber); }
+.hljs-tag .hljs-string { color:var(--str); }

package/public/css/hub.css

@@ -14,3 +14,12 @@ body.hub #stage { display:flex; align-items:center; padding:20px 40px; }
 .card.ws .nm { font:600 16px/1.3 var(--serif); color:var(--ink); margin:0 0 4px; }
 .card.ws .pth { font:400 11px/1.4 var(--mono); color:var(--ink-3); overflow:hidden; text-overflow:ellipsis; white-space:nowrap; margin:0 0 6px; }
 .card.ws .meta { font:400 11px/1.4 var(--mono); color:var(--ink-3); margin:0; }
+/* dispositivos: QR de emparejamiento */
+.pairqr { display:flex; gap:16px; align-items:flex-start; margin-top:16px; flex-wrap:wrap; }
+.pairqr .qr { width:220px; height:220px; background:#fff; border-radius:var(--r); padding:6px; }
+.pairqr .qr svg { width:100%; height:100%; display:block; }
+.pairqr .qrmeta { display:flex; flex-direction:column; gap:8px; min-width:180px; flex:1; }
+@media (max-width: 640px) {
+  body.hub #stage { padding:16px; align-items:flex-start; }
+  .wsgrid { grid-template-columns:1fr; }
+}

package/public/css/login.css

@@ -0,0 +1,16 @@
+/* login.css — /login y /pair: una tarjeta centrada, pensada primero para el celular */
+body.auth { display:flex; align-items:center; justify-content:center; min-height:100vh; min-height:100dvh; padding:24px 16px calc(24px + env(safe-area-inset-bottom)); }
+.authbox { width:100%; max-width:400px; }
+.authbox .logo { display:block; margin:0 0 18px; border-radius:10px; }
+.authbox .eyebrow { font:400 11px/1 var(--mono); letter-spacing:.08em; text-transform:uppercase; color:var(--ink-3); margin:0 0 8px; }
+.authbox h1 { font:600 26px/1.2 var(--serif); margin:0 0 10px; }
+.authbox .lead { color:var(--ink-2); margin:0 0 22px; }
+.authbox .hint { font:400 12px/1.5 var(--mono); color:var(--ink-3); margin:18px 0 0; }
+.authbox .field { display:block; font:400 11px/1 var(--mono); color:var(--ink-3); margin:0 0 16px; }
+.authbox .field input { display:block; width:100%; margin-top:6px; padding:12px; font:400 16px var(--mono); color:var(--ink); background:var(--paper-2); border:1px solid var(--rule-2); border-radius:var(--r); }
+.authbox .field input:focus { outline:none; border-color:var(--accent); }
+.authbox button.primary { width:100%; padding:14px; font:600 15px var(--mono); color:var(--paper); background:var(--accent); border:0; border-radius:var(--r); cursor:pointer; }
+.authbox button.primary:disabled { opacity:.55; cursor:default; }
+.authbox .msg { font:400 13px/1.5 var(--mono); margin:16px 0 0; min-height:1.5em; color:var(--ink-2); }
+.authbox .msg.err { color:var(--rubric); }
+.authbox .msg.ok { color:var(--ok); }

package/public/css/mobile.css

@@ -0,0 +1,95 @@
+/* mobile.css — la vista de celular (≤ 900 px), con js/mobile.js. Va ÚLTIMA en la cascada: solo pisa lo que cambia.
+   Barra inferior Chat · Sesiones · Archivos · Más; chips de agente/permisos/modelo sobre la caja de texto; paneles y
+   modales a pantalla completa; nada más ancho que la pantalla (el código y las tablas se deslizan dentro de su caja). */
+@media (min-width:901px) { .mtabs, .mchips, .msheet, .mnew { display:none !important; } }
+
+@media (max-width:900px) {
+  html, body { height:100%; overflow:hidden; }
+  body { height:100dvh; grid-template-columns:minmax(0,1fr); grid-template-rows:auto minmax(0,1fr) auto; grid-template-areas:"top" "main" "tabs"; }
+
+  /* header: una fila — dónde estás, ⚙ y tema; la segunda fila se reparte entre los chips y «Más» */
+  header { padding-top:env(safe-area-inset-top); }
+  header .hrow { height:48px; padding:0 8px 0 14px; gap:4px; }
+  header .hrow.sub { display:none; }
+  header #term, header #new { display:none; }
+  .brand { flex:1; min-width:0; overflow:hidden; text-overflow:ellipsis; font-size:15px; }
+  header .spacer { display:none; }
+  .theme-toggle { padding:10px; }
+
+  /* paneles: uno por pestaña, a pantalla completa en el lugar del chat */
+  aside { display:none; }
+  body[data-mtab="side"] aside:not(.right), body[data-mtab="files"] aside.right { display:flex; grid-area:main; border:0; overflow:auto; }
+  body[data-mtab="side"] main, body[data-mtab="files"] main { display:none; }
+  aside .fold, aside .rail { display:none !important; }
+  aside.closed .sec { display:flex; }
+  aside .sec h2 { padding:15px 16px 12px; font-size:11.5px; }
+  aside.right h2, aside:not(.right) > .sec:first-of-type h2 { padding-right:16px; }
+  aside .sec .body { padding:0 12px 12px 16px; font-size:15px; }
+  aside .sec .body > * { min-height:34px; }
+  .mnew { flex:none; margin:12px 14px 4px; padding:12px; font:600 11.5px/1 var(--mono); text-transform:uppercase; letter-spacing:.09em; color:var(--accent); background:var(--accent-bg); border:1px solid var(--accent); border-radius:var(--r); cursor:pointer; }
+
+  /* chat: todo el ancho, nada más ancho que la pantalla */
+  #log { padding:14px 16px 18px; max-width:none; }
+  #log.hero { padding:18px 16px; align-items:flex-start; }
+  .user, .assistant, .step { overflow-wrap:anywhere; }
+  .assistant pre, .step pre { max-width:100%; }
+  .assistant table { display:block; max-width:100%; overflow-x:auto; }
+  .assistant img { max-width:100%; height:auto; }
+  .empty code { white-space:normal; }
+  .empty .grid { grid-template-columns:minmax(0,1fr); }
+  .approval .card { max-width:none; }
+  .approval .card button { min-height:40px; }
+
+  /* composer: chips arriba, texto de 16 px (iOS no hace zoom), botón grande para el dedo */
+  form { padding:8px 10px 10px; }
+  /* el texto y el botón en la misma fila (como en cualquier app de mensajes); las imágenes pegadas, arriba */
+  .composer { display:flex; flex-wrap:wrap; align-items:flex-end; gap:8px; padding:6px 6px 6px 12px; }
+  .composer .attach { flex-basis:100%; }
+  .composer textarea { flex:1; width:auto; min-width:0; min-height:0; font-size:16px; max-height:30vh; padding:7px 0; }
+  .crow { flex:none; margin:0; }
+  .crow .keys, .crow .tools { display:none; }
+  #send { width:44px; height:40px; font-size:17px; }
+  #stop { height:40px; }
+  /* chips: UNA fila que se desliza de costado (en 4 renglones le comían medio chat) */
+  .mchips { display:flex; flex-wrap:nowrap; gap:6px; margin:0 -10px 8px; padding:0 10px; overflow-x:auto; scrollbar-width:none; }
+  .mchips::-webkit-scrollbar { display:none; }
+  .mchips #wsPill { display:none !important; }
+  .mchips select, .mchips .pill { flex:none; height:30px; font:400 12px/1 var(--mono); color:var(--ink-2); background:var(--paper-2); border:1px solid var(--rule-2); border-radius:15px; padding:0 10px; }
+  .mchips select { padding-right:4px; }
+  .mchips .pill { display:inline-flex; align-items:center; max-width:62vw; }
+  .mchips .pill.on { color:var(--accent); }
+  .mchips .pill.nokey { color:var(--rubric); }
+
+  /* barra inferior */
+  .mtabs { grid-area:tabs; display:flex; background:var(--paper); border-top:1px solid var(--rule); padding-bottom:env(safe-area-inset-bottom); }
+  .mtabs button { flex:1; position:relative; display:flex; flex-direction:column; align-items:center; gap:3px; padding:9px 0 7px; background:none; border:0; color:var(--ink-3); font:400 10.5px/1 var(--mono); letter-spacing:.04em; cursor:pointer; -webkit-tap-highlight-color:transparent; }
+  .mtabs button.on { color:var(--accent); }
+  .mtabs .badge { position:absolute; top:4px; left:calc(50% + 8px); min-width:16px; height:16px; padding:0 4px; border-radius:8px; background:var(--rubric); color:#fff; font:600 10px/16px var(--mono); font-style:normal; }
+
+  /* «Más»: hoja desde abajo */
+  .msheet { position:fixed; inset:0; z-index:70; display:flex; flex-direction:column; justify-content:flex-end; }
+  .msheet .mback { position:absolute; inset:0; background:rgba(0,0,0,.45); }
+  .msheet .mcard { position:relative; background:var(--paper); border-top:1px solid var(--rule-2); border-radius:12px 12px 0 0; padding:10px 12px calc(12px + env(safe-area-inset-bottom)); display:flex; flex-direction:column; gap:4px; }
+  .msheet .mwhere { padding:8px 6px 10px; border-bottom:1px solid var(--rule); margin-bottom:4px; font:400 12px/1.5 var(--mono); color:var(--ink-3); overflow-wrap:anywhere; }
+  .msheet .mgit { color:var(--ink-2); margin-bottom:2px; }
+  .msheet button { text-align:left; padding:14px 8px; background:none; border:0; border-radius:var(--r); color:var(--ink); font:400 16px/1 var(--serif); text-transform:none; letter-spacing:0; cursor:pointer; }
+  .msheet button:active { background:var(--paper-2); }
+  .msheet .mcancel { text-align:center; color:var(--ink-3); font:400 12px/1 var(--mono); text-transform:uppercase; letter-spacing:.09em; margin-top:4px; border-top:1px solid var(--rule); border-radius:0; }
+
+  /* modales (configuración, sesiones, plugins…): pantalla completa; en «browse» la lista arriba y el detalle abajo */
+  .modal { align-items:stretch; justify-content:stretch; }
+  .panel, .panel.lg, .panel.md, .panel.sm { width:100vw; height:100dvh; max-height:none; border:0; border-radius:0; box-shadow:none; padding:calc(10px + env(safe-area-inset-top)) 14px calc(12px + env(safe-area-inset-bottom)); }
+  .panel .browse { grid-template-columns:minmax(0,1fr); grid-template-rows:minmax(0,38%) minmax(0,1fr); }
+  .panel .blist { border-right:0; border-bottom:1px solid var(--rule); padding:10px 0 8px; }
+  .panel .bdetail { padding:12px 2px 8px; }
+  .panel input, .panel select, .panel textarea { font-size:16px; }
+  .panel .pghost { width:36px; height:36px; flex:none; }
+  /* cabecera del modal: la ✕ siempre a la vista (la ruta de «sub» la empujaba fuera de la pantalla) */
+  .panel .phead { gap:8px; min-width:0; }
+  .panel .phead .sub { display:none; }
+  .panel .phead h3 { min-width:0; overflow:hidden; text-overflow:ellipsis; white-space:nowrap; }
+
+  /* terminal y visor de archivos: el ancho de la pantalla */
+  #termpane .vh { overflow-x:auto; }
+  #viewer pre { font-size:12px; }
+}

package/public/css/panel.css

@@ -154,3 +154,33 @@
 .panel .wsbrowser .bitems { max-height:30vh; overflow-y:auto; padding:4px; }
 .panel .wsbrowser .bfoot { padding:8px 10px; border-top:1px solid var(--rule); display:flex; justify-content:flex-end; }
 .panel .wsbrowser .bfoot button { font:400 12px/1 var(--mono); padding:6px 12px; }
+/* computer use (⚙ → Computer use): estado del driver externo e instrucciones de instalación */
+.panel .cu-status { margin:4px 0 14px; padding:10px 12px; border:1px solid var(--rule); border-radius:var(--r); }
+.panel .cu-line { font:500 12.5px/1.5 var(--mono); color:var(--ink); }
+.panel .cu-line.ok { color:#3fb950; }
+.panel .cu-line.warn { color:#d29922; }
+.panel .cu-line.no { color:var(--ink-3); }
+.panel .cu-status ul { margin:6px 0 0 16px; padding:0; }
+.panel .cu-status p { margin:6px 0; }
+.panel .cu-cmd { margin:8px 0; padding:8px 10px; border:1px dashed var(--rule); border-radius:var(--r); font:12px/1.5 var(--mono); color:var(--ink); white-space:pre-wrap; user-select:all; }
+.panel .dform label .chk { display:flex; align-items:center; gap:8px; font:400 13px/1.4 var(--serif); text-transform:none; letter-spacing:0; color:var(--ink); }
+.panel .dform label .chk input { width:16px; height:16px; margin:0; accent-color:var(--accent); }
+/* interruptor visible (computer use): pill con perilla; el texto al lado dice el estado */
+.panel label.toggle { position:relative; display:inline-flex; align-items:center; gap:10px; margin:0 0 0 auto; cursor:pointer; user-select:none; font:500 12.5px/1 var(--mono); text-transform:none; letter-spacing:0; color:var(--ink-3); }
+.panel .dform .trow label.toggle { margin:0; font:500 13px/1.3 var(--serif); color:var(--ink); }
+.panel label.toggle input { position:absolute; opacity:0; width:0; height:0; margin:0; }
+.panel label.toggle .knob { position:relative; flex:none; width:40px; height:22px; border-radius:11px; background:var(--rule); border:1px solid var(--rule); box-sizing:border-box; transition:background .15s, border-color .15s; }
+.panel label.toggle .knob::after { content:""; position:absolute; top:2px; left:2px; width:16px; height:16px; border-radius:50%; background:var(--ink); opacity:.75; transition:left .15s, background .15s, opacity .15s; }
+.panel label.toggle input:checked + .knob { background:var(--accent); border-color:var(--accent); }
+.panel label.toggle input:checked + .knob::after { left:20px; background:var(--paper); opacity:1; }
+.panel label.toggle input:disabled + .knob { opacity:.45; cursor:not-allowed; }
+.panel label.toggle.on { color:var(--accent); }
+.panel .dform .trow label.toggle.on { color:var(--ink); }
+.panel .dform .trow { display:flex; flex-direction:column; gap:6px; margin:4px 0 16px; }
+/* ⚙ Apagar o reiniciar: botones que se confirman en el lugar (inlineConfirm) */
+.panel .dform .trow .hbtn.pwr { align-self:flex-start; }
+.panel .dform .trow .hbtn.pwr.danger { color:var(--rubric); border-color:var(--rubric); }
+.panel .dform .trow .hbtn.pwr:disabled { opacity:.45; cursor:default; }
+.panel .dform .trow .hbtn.pwr.ask { text-transform:none; letter-spacing:0; }
+.panel .dform .trow .hbtn.pwr.ask .yes { color:var(--rubric); cursor:pointer; text-decoration:underline; }
+.panel .dform .trow .hbtn.pwr.ask .no { cursor:pointer; }

package/public/css/tokens.css

@@ -1,5 +1,5 @@
 /* tokens: fuentes, paleta (dark/light), base y botones — lo que todo lo demás asume */
-/* Misma dirección que docs.synsema.com: tinta sobre papel, una superfamilia (IBM Plex) en dos
+/* Misma dirección que synsema.dev: tinta sobre papel, una superfamilia (IBM Plex) en dos
    voces — la SERIF para lo que se lee (mensajes, hero), la MONO para estructura y maquinaria
    (header, sidebar, pasos, código, controles). El color se raciona: azul = link / dónde estás,
    rubric rojo = peligro y permisos (la única cosa que vale la pena ver desde lejos). */