{% extends "admin/_layout.html" %}
{% from "_macros.html" import icon %}
{% set section = "agents" %}

{% block title %}Agents - LLeMbas{% endblock %}
{% block heading %}Agents{% endblock %}

{% block admin_content %}
<p class="admin-lede">
  An <strong>Agent</strong> chat can read files, write files and run commands on
  a machine reached over SSH. Nothing runs on this server. People add their own
  connections under <strong>Connections</strong>; what you decide here is
  whether the feature exists and what one reply may spend.
</p>

<div class="alert">
  {{ icon("shield", "icon--sm") }}
  <span>
    There is no sandbox to configure, and that is deliberate: containment is
    whatever host somebody points a connection at. A container built for the
    job is a very different thing from a key to a live server, and LLeMbas
    cannot tell them apart. What a model reads — a web page, a file, the output
    of the last command — is untrusted, and in <strong>Auto</strong> mode
    nothing stands between that and a command running.
  </span>
</div>

{% if problem %}
<div class="alert alert--error">{{ icon("warning", "icon--sm") }} <span>{{ problem }}</span></div>
{% endif %}

{% if saved %}
<div class="alert alert--success">{{ icon("check", "icon--sm") }} <span>Saved.</span></div>
{% endif %}

<form method="post" action="/admin/agents" class="form-grid">

  <section class="card">
    <h2 class="card__title">Switch</h2>
    <div class="field">
      <label class="checkbox">
        <input type="checkbox" name="enabled" value="true" {{ 'checked' if values.enabled }}>
        <span>Allow agent chats</span>
      </label>
      <p class="field__hint">
        Off, nobody can start one and no agent tool is offered, whatever
        permissions they hold. {{ profile_count }} connection{{ '' if profile_count == 1 else 's' }}
        saved across all accounts.
      </p>
    </div>
    <p class="field__hint">
      People also need the <strong>Run commands</strong> permission, a model
      flagged <strong>Agent execution</strong>, and a connection of their own.
    </p>
  </section>

  <section class="card">
    <h2 class="card__title">The modes</h2>
    <p class="field__hint">
      Set per chat and switchable at any time. This is what each one means; the
      two lists below adjust them.
    </p>
    <dl class="mode-list">
      {% for value, label, hint in modes %}
      <div class="mode-list__row">
        <dt><strong>{{ label }}</strong></dt>
        <dd>{{ hint }}</dd>
      </div>
      {% endfor %}
    </dl>
  </section>

  <section class="card">
    <h2 class="card__title">What never needs asking</h2>
    <div class="field">
      <label class="field__label" for="allow_default">Always allow</label>
      <textarea class="textarea input--mono" id="allow_default" name="allow_default" rows="5"
                spellcheck="false">{{ allow_text }}</textarea>
      <p class="field__hint">
        One per line: a tool name like <code>file_read</code>, or a command with
        wildcards like <code>git *</code>. A command containing anything that
        joins two commands together — a semicolon, a pipe, backticks — can never
        match one of these, so <code>git *</code> does not quietly also mean
        <code>git status; curl … | sh</code>.
      </p>
    </div>
  </section>

  <section class="card">
    <h2 class="card__title">What always needs asking</h2>
    <div class="field">
      <label class="field__label" for="deny_default">Always ask</label>
      <textarea class="textarea input--mono" id="deny_default" name="deny_default" rows="5"
                spellcheck="false">{{ deny_text }}</textarea>
      <p class="field__hint">
        Checked before everything, including <strong>Auto</strong>. Treat it as
        a guard against an accident rather than against an adversary:
        <code>rm -rf /*</code> here does not stop <code>/bin/rm -rf /</code>, and
        nothing pattern-shaped could.
      </p>
    </div>
  </section>

  <section class="card">
    <h2 class="card__title">What one command may spend</h2>

    <div class="field">
      <label class="field__label" for="default_timeout">Timeout (seconds)</label>
      <input class="input" id="default_timeout" name="default_timeout"
             value="{{ values.default_timeout }}" inputmode="numeric">
    </div>
    <div class="field">
      <label class="field__label" for="max_timeout">Longest a command may ask for</label>
      <input class="input" id="max_timeout" name="max_timeout"
             value="{{ values.max_timeout }}" inputmode="numeric">
    </div>
    <div class="field">
      <label class="field__label" for="max_output_bytes">Most output to keep</label>
      <input class="input" id="max_output_bytes" name="max_output_bytes"
             value="{{ values.max_output_bytes }}" inputmode="numeric">
      <p class="field__hint">
        Characters. The rest is cut off and the model is told so.
      </p>
    </div>
  </section>

  <section class="card">
    <h2 class="card__title">What one reply may spend</h2>
    <p class="field__hint">
      Three separate bounds, because they fail differently: steps stop a loop,
      the clock stops one slow command eating an afternoon, and output stops a
      model filling its own context with build logs and having no room to answer.
    </p>

    <div class="field">
      <label class="field__label" for="max_steps">Most rounds of tool calls</label>
      <input class="input" id="max_steps" name="max_steps"
             value="{{ values.max_steps }}" inputmode="numeric">
    </div>
    <div class="field">
      <label class="field__label" for="max_wall_seconds">Longest a reply may take</label>
      <input class="input" id="max_wall_seconds" name="max_wall_seconds"
             value="{{ values.max_wall_seconds }}" inputmode="numeric">
      <p class="field__hint">Time spent waiting for you to answer does not count.</p>
    </div>
    <div class="field">
      <label class="field__label" for="max_total_output_bytes">Most output across a reply</label>
      <input class="input" id="max_total_output_bytes" name="max_total_output_bytes"
             value="{{ values.max_total_output_bytes }}" inputmode="numeric">
    </div>
  </section>

  <section class="card">
    <h2 class="card__title">Asking you things</h2>

    <div class="field">
      <label class="field__label" for="approval_timeout">How long a question waits</label>
      <input class="input" id="approval_timeout" name="approval_timeout"
             value="{{ values.approval_timeout }}" inputmode="numeric">
      <p class="field__hint">
        Seconds. After this the reply carries on without an answer and says so.
        At least a minute, whatever is typed here.
      </p>
    </div>

    <div class="field">
      <label class="checkbox">
        <input type="checkbox" name="ask_free_text" value="true"
               {{ 'checked' if values.ask_free_text }}>
        <span>Let people write their own answer</span>
      </label>
      <p class="field__hint">
        When a model asks a question it can offer answers to pick from, and by
        default a box to write something else. Turn this off if you would rather
        nobody typed free text into a prompt a model composed.
      </p>
    </div>
  </section>

  <div class="btn-row">
    <button class="btn btn--primary" type="submit">Save changes</button>
  </div>
</form>
{% endblock %}