A connection that cannot point at the machine it is running on

"Nothing runs on the LLeMbas host" is the sentence the absent sandbox and the
absent local MCP rest on, and an SSH profile aimed at 127.0.0.1 walked straight
past it -- through a real login, with every gate in policy.py still applying,
onto the machine holding the database and the Fernet key. From the SSH layer
down it is indistinguishable from a container on the network, so nothing here
could have noticed.

One switch, three positions: never, one named port, anywhere. The middle one is
the one with a real use -- a container that published its SSH port on the
loopback interface is genuinely somewhere else -- and port 22 is refused even
there, because that one is this host's own sshd.

Enforced in five places, because a row can predate a setting: saving a profile,
`session.resolve` (the control every agent tool, the terminal and the canvas go
through), the composer's picker, browsing, and the draft the panels open against
before a chat exists. Check refuses before it opens its socket rather than after.

And the recognition never resolves a name on the request path. `refusal` runs
several times per page render; the first version of this looked names up inline
and the suite went from two minutes to not finishing. Literal forms are decided
from the string, a name is settled where a network call is already expected, and
the answer lives on the row. The gap that leaves is written down rather than
discovered.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/lembas/web/templates/admin/agents.html

@@ -54,6 +54,39 @@
     </p>
   </section>
 
+  <section class="card">
+    <h2 class="card__title">Connections to this machine</h2>
+    <p class="card__lede">
+      Agent chats reach a machine over SSH, and the point of that is that it is
+      not this one — nothing runs on the host holding the database and the
+      encryption key. A connection pointed at <code>127.0.0.1</code> walks past
+      that, and from the SSH layer's point of view it looks like any other host.
+      {% if loopback_count %}
+      <strong>{{ loopback_count }} saved connection{{ '' if loopback_count == 1 else 's' }}
+      point{{ 's' if loopback_count == 1 else '' }} here.</strong>
+      {% endif %}
+    </p>
+    <div class="field">
+      {% for value, label, hint in loopback_modes %}
+      <label class="checkbox">
+        <input type="radio" name="loopback" value="{{ value }}"
+               {{ 'checked' if (values.loopback or 'off') == value }}>
+        <span><strong>{{ label }}</strong> — {{ hint }}</span>
+      </label>
+      {% endfor %}
+    </div>
+    <div class="field">
+      <label class="field__label" for="loopback_port">The allowed port</label>
+      <input class="input" type="number" id="loopback_port" name="loopback_port"
+             min="0" max="65535" step="1" value="{{ values.loopback_port or 0 }}">
+      <p class="field__hint">
+        Only read when the position above is <strong>Only on one port</strong>.
+        Port 22 is refused whatever is typed here — that one is this host's own
+        sshd, not a container that published its port on the loopback interface.
+      </p>
+    </div>
+  </section>
+
   <section class="card">
     <h2 class="card__title">The modes</h2>
     <p class="field__hint">

src/lembas/web/templates/agents/detail.html

@@ -17,6 +17,13 @@
 {% if problem %}
 <div class="alert alert--error">{{ icon("warning", "icon--sm") }} <span>{{ problem }}</span></div>
 {% endif %}
+{# A connection saved before an administrator moved the switch. It is still here
+   and still editable -- pointing it at another host is the way out -- but
+   nothing will use it, and saying so here is the only place somebody looking at
+   this row would find out. #}
+{% if refused %}
+<div class="alert alert--error">{{ icon("shield", "icon--sm") }} <span>{{ refused }}</span></div>
+{% endif %}
 {% if saved %}
 <div class="alert alert--success">{{ icon("check", "icon--sm") }} <span>{{ saved }}</span></div>
 {% endif %}

src/lembas/web/templates/agents/index.html

@@ -62,11 +62,18 @@
 
 <div class="model-rows">
   {% for profile in profiles %}
-  <div class="model-row {{ 'is-off' if not profile.enabled }}">
+  {# `refused` is why this connection cannot be used at all, which is a stronger
+     statement than `disabled` -- that one is the owner's own choice and this one
+     is not theirs to make. Greyed out with the same class, because "you cannot
+     use this" is one visual idea however it came about. #}
+  {% set refused = refusals.get(profile.id, "") %}
+  <div class="model-row {{ 'is-off' if not profile.enabled or refused }}">
     <div class="model-row__main">
       <div class="model-row__title">
         <a class="model-row__name" href="/agents/{{ profile.id }}">{{ profile.name }}</a>
-        {% if profile.verified %}
+        {% if refused %}
+        <span class="badge badge--danger">not allowed</span>
+        {% elif profile.verified %}
         <span class="badge badge--leaf">key confirmed</span>
         {% else %}
         <span class="badge badge--danger">not checked</span>
@@ -77,7 +84,9 @@
       <code class="model-row__id">
         {{ profile.address }}{% if profile.default_dir %} · {{ profile.default_dir }}{% endif %}
       </code>
-      {% if profile.last_error %}
+      {% if refused %}
+      <p class="text-xs danger">{{ refused }}</p>
+      {% elif profile.last_error %}
       <p class="text-xs danger">{{ profile.last_error }}</p>
       {% elif profile.server_info.system %}
       <p class="text-xs faint">{{ profile.server_info.system }}</p>