{% extends "admin/_layout.html" %}
{% from "_macros.html" import icon %}
{% set section = "agents" %}

{% block title %}Agents - LLeMbas{% endblock %}
{% block heading %}Agents{% endblock %}

{% block admin_content %}
<p class="admin-lede">
  An <strong>Agent</strong> chat can read files, write files and run commands on
  a machine reached over SSH. Nothing runs on this server. People add their own
  connections under <strong>Connections</strong>; what you decide here is
  whether the feature exists and what one reply may spend.
</p>

<div class="alert">
  {{ icon("shield", "icon--sm") }}
  <span>
    There is no sandbox to configure, and that is deliberate: containment is
    whatever host somebody points a connection at. A container built for the
    job is a very different thing from a key to a live server, and LLeMbas
    cannot tell them apart. What a model reads — a web page, a file, the output
    of the last command — is untrusted, and in <strong>Auto</strong> mode
    nothing stands between that and a command running.
  </span>
</div>

{% if problem %}
<div class="alert alert--error">{{ icon("warning", "icon--sm") }} <span>{{ problem }}</span></div>
{% endif %}

{% if saved %}
<div class="alert alert--success">{{ icon("check", "icon--sm") }} <span>Saved.</span></div>
{% endif %}

<form method="post" action="/admin/agents" class="form-grid">

  <section class="card">
    <h2 class="card__title">Switch</h2>
    <div class="field">
      <label class="checkbox">
        <input type="checkbox" name="enabled" value="true" {{ 'checked' if values.enabled }}>
        <span>Allow agent chats</span>
      </label>
      <p class="field__hint">
        Off, nobody can start one and no agent tool is offered, whatever
        permissions they hold. {{ profile_count }} connection{{ '' if profile_count == 1 else 's' }}
        saved across all accounts.
      </p>
    </div>
    <p class="field__hint">
      People also need the <strong>Run commands</strong> permission, a model
      flagged <strong>Agent execution</strong>, and a connection of their own.
    </p>
  </section>

  <section class="card">
    <h2 class="card__title">The modes</h2>
    <p class="field__hint">
      Set per chat and switchable at any time. This is what each one means; the
      two lists below adjust them.
    </p>
    <dl class="mode-list">
      {% for value, label, hint in modes %}
      <div class="mode-list__row">
        <dt><strong>{{ label }}</strong></dt>
        <dd>{{ hint }}</dd>
      </div>
      {% endfor %}
    </dl>
  </section>

  <section class="card">
    <h2 class="card__title">What never needs asking</h2>
    <div class="field">
      <label class="field__label" for="allow_default">Always allow</label>
      <textarea class="textarea input--mono" id="allow_default" name="allow_default" rows="5"
                spellcheck="false">{{ allow_text }}</textarea>
      <p class="field__hint">
        One per line: a tool name like <code>file_read</code>, or a command with
        wildcards like <code>git *</code>. A command containing anything that
        joins two commands together — a semicolon, a pipe, backticks — can never
        match one of these, so <code>git *</code> does not quietly also mean
        <code>git status; curl … | sh</code>.
      </p>
    </div>
  </section>

  <section class="card">
    <h2 class="card__title">What always needs asking</h2>
    <div class="field">
      <label class="field__label" for="deny_default">Always ask</label>
      <textarea class="textarea input--mono" id="deny_default" name="deny_default" rows="5"
                spellcheck="false">{{ deny_text }}</textarea>
      <p class="field__hint">
        Checked before everything, including <strong>Auto</strong>. Treat it as
        a guard against an accident rather than against an adversary:
        <code>rm -rf /*</code> here does not stop <code>/bin/rm -rf /</code>, and
        nothing pattern-shaped could.
      </p>
    </div>
  </section>

  <section class="card">
    <h2 class="card__title">What one command may spend</h2>

    <div class="field">
      <label class="field__label" for="default_timeout">Timeout (seconds)</label>
      <input class="input" id="default_timeout" name="default_timeout"
             value="{{ values.default_timeout }}" inputmode="numeric">
    </div>
    <div class="field">
      <label class="field__label" for="max_timeout">Longest a command may ask for</label>
      <input class="input" id="max_timeout" name="max_timeout"
             value="{{ values.max_timeout }}" inputmode="numeric">
    </div>
    <div class="field">
      <label class="field__label" for="max_output_bytes">Most output to keep</label>
      <input class="input" id="max_output_bytes" name="max_output_bytes"
             value="{{ values.max_output_bytes }}" inputmode="numeric">
      <p class="field__hint">
        Characters. The rest is cut off and the model is told so.
      </p>
    </div>
  </section>

  <section class="card">
    <h2 class="card__title">What one reply may spend</h2>
    <p class="field__hint">
      Three separate bounds, because they fail differently: steps stop a loop,
      the clock stops one slow command eating an afternoon, and output stops a
      model filling its own context with build logs and having no room to answer.
    </p>

    <div class="field">
      <label class="field__label" for="max_steps">Most rounds of tool calls</label>
      <input class="input" id="max_steps" name="max_steps"
             value="{{ values.max_steps }}" inputmode="numeric">
    </div>
    <div class="field">
      <label class="field__label" for="max_wall_seconds">Longest a reply may take</label>
      <input class="input" id="max_wall_seconds" name="max_wall_seconds"
             value="{{ values.max_wall_seconds }}" inputmode="numeric">
      <p class="field__hint">Time spent waiting for you to answer does not count.</p>
    </div>
    <div class="field">
      <label class="field__label" for="max_total_output_bytes">Most output across a reply</label>
      <input class="input" id="max_total_output_bytes" name="max_total_output_bytes"
             value="{{ values.max_total_output_bytes }}" inputmode="numeric">
    </div>
  </section>

  <section class="card">
    <h2 class="card__title">Asking you things</h2>

    <div class="field">
      <label class="field__label" for="approval_timeout">How long a question waits</label>
      <input class="input" id="approval_timeout" name="approval_timeout"
             value="{{ values.approval_timeout }}" inputmode="numeric">
      <p class="field__hint">
        Seconds. After this the reply carries on without an answer and says so.
        At least a minute, whatever is typed here.
      </p>
    </div>

    <div class="field">
      <label class="checkbox">
        <input type="checkbox" name="ask_free_text" value="true"
               {{ 'checked' if values.ask_free_text }}>
        <span>Let people write their own answer</span>
      </label>
      <p class="field__hint">
        When a model asks a question it can offer answers to pick from, and by
        default a box to write something else. Turn this off if you would rather
        nobody typed free text into a prompt a model composed.
      </p>
    </div>
  </section>

  <section class="card">
    <h2 class="card__title">The terminal</h2>
    <p class="field__hint">
      A panel beside an agent chat holding an interactive shell on that chat's
      own connection. What somebody types there is <em>theirs</em>: the modes and
      the two lists above govern the model, not the person at the keyboard, who
      could open the same shell with an ssh client. The model cannot see the
      panel; sending it something is a button they press.
    </p>

    <div class="field">
      <label class="checkbox">
        <input type="checkbox" name="terminal_enabled" value="true"
               {{ 'checked' if values.terminal_enabled }}>
        <span>Allow the terminal panel</span>
      </label>
      <p class="field__hint">
        People also need the <strong>Open a terminal</strong> permission.
        {{ terminal_count }} shell{{ '' if terminal_count == 1 else 's' }} open right now.
      </p>
    </div>

    <div class="field">
      <label class="field__label" for="terminal_idle_timeout">Close a shell after</label>
      <input class="input" id="terminal_idle_timeout" name="terminal_idle_timeout"
             value="{{ values.terminal_idle_timeout }}" inputmode="numeric">
      <p class="field__hint">
        Seconds with nobody watching <em>and</em> nothing typed. Closing the
        panel does not end the session — a build carries on and is still there
        on the way back — so this is what eventually ends one.
      </p>
    </div>
    <div class="field">
      <label class="field__label" for="terminal_max_sessions">Most shells at once</label>
      <input class="input" id="terminal_max_sessions" name="terminal_max_sessions"
             value="{{ values.terminal_max_sessions }}" inputmode="numeric">
    </div>
    <div class="field">
      <label class="field__label" for="terminal_max_per_user">Most shells per person</label>
      <input class="input" id="terminal_max_per_user" name="terminal_max_per_user"
             value="{{ values.terminal_max_per_user }}" inputmode="numeric">
      <p class="field__hint">
        One per chat. Each holds an SSH connection open on the far machine.
      </p>
    </div>
  </section>

  <section class="card">
    <h2 class="section-title">The project directory</h2>
    <p class="muted">
      A listing of the directory a chat works in, so a reply does not spend its
      first rounds finding out what is there — and so files can be attached by
      name with <strong>@</strong>. Built by one read-only command
      (<code>git ls-files</code> where it works, otherwise <code>find</code>),
      cached briefly, and shared by every chat pointed at the same directory.
    </p>

    <div class="field">
      <label class="checkbox">
        <input type="checkbox" name="index_enabled"
               {{ 'checked' if values.index_enabled }}>
        <span>List the project directory</span>
      </label>
      <p class="field__hint">
        Off means no listing is built at all, and the file picker offers only
        what is in the library.
      </p>
    </div>

    <div class="field">
      <label class="field__label" for="index_chars">Characters of it in the prompt</label>
      <input class="input" id="index_chars" name="index_chars"
             value="{{ values.index_chars }}" inputmode="numeric">
      <p class="field__hint">
        This is spent on <em>every</em> request in an agent chat, so it is a
        budget rather than a limit: directories that will not fit are shown as
        a count and the model is told to look inside them itself.
        <strong>0</strong> keeps the listing for the file picker and puts none
        of it in the prompt.
      </p>
    </div>
  </section>

  <div class="btn-row">
    <button class="btn btn--primary" type="submit">Save changes</button>
  </div>
</form>
{% endblock %}