Look around the machine before deciding to talk about it

The terminal and the canvas both needed a Chat, so they were missing from the
one screen where you are choosing which machine to work on. A draft is the
smallest thing that fixes it: an id, and the three facts behind it.

The trick is that a draft resolves to a *transient* Chat -- constructed, never
added to a session. `canvas.agent_ready`, `_executor`, `_load_agent`, `_save_agent`
and `agent_session.resolve` read exactly four attributes between them and none
of them queries or writes the row, so all of it works unchanged and nothing had
to learn what a draft is. Proven against a real sshd rather than a stub: a
transient chat opens and saves a project file over the same SFTP path a real one
uses, and the database stays empty throughout.

Chats are still created lazily. A draft is not a chat and never becomes one;
when the first prompt makes the real one, the shell is re-keyed into it and the
open tabs are copied across. `terminal.rekey` moves the registry key *and*
`session.chat_id`, because close_for_profile, close_for_owner and the reaper all
pop by the field -- a stale one would leave a dead session that `get` keeps
handing out. The shell is only adopted when its profile and directory match the
chat as finally resolved, since `_new_chat` settles an empty directory to the
connection's own; otherwise it is left alone rather than transplanted onto a
chat that says it runs elsewhere.

Two canvas sources are refused on a draft, by name, and one of them is a hole
rather than an inconvenience. `_load_file` authorises with
`attachment.chat_id != chat.id`, and an upload made on the new-chat screen is
stored with `chat_id=None` -- so a draft whose chat carried no id would make that
comparison `None != None`, which is False, and open every unclaimed attachment
its owner has. `as_chat` does set an id, so it already fails; the refusal is
stated anyway, because a guarantee that lives in an id-shaped coincidence is one
the next change breaks without noticing.

Adoption needed almost no JavaScript: start_chat already answers with
HX-Redirect, so the page reloads and the canvas adopts by construction while the
terminal reconnects to the re-keyed session and replays its scrollback -- the "a
reload is indistinguishable from a second tab" property working for us. What
re-points them mid-screen is a `lembas:agent-target` event, dispatched from
`setDir` and the connection select because assigning to a hidden field's value
fires nothing on its own. Driven under a DOM stub before committing.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/lembas/api/terminal.py

@@ -35,6 +35,7 @@ from lembas.db.session import session_scope
 from lembas.security import permissions
 from lembas.security.sessions import COOKIE_NAME, resolve_session
 from lembas.services import settings_store
+from lembas.services.agent import draft as draft_service
 from lembas.services.agent import session as agent_session
 from lembas.services.agent import terminal as terminal_service
 from lembas.services.agent.base import ExecError
@@ -75,6 +76,20 @@ def _same_origin(websocket: WebSocket) -> bool:
     return urlsplit(origin).netloc.lower() == host.lower()
 
 
+def _chat_or_draft(db, user, chat_id: str):
+    """The chat this panel belongs to, real or still being decided.
+
+    A draft resolves to a transient `Chat` -- see services/agent/draft.py --
+    which is what lets the terminal open on the new-chat screen without
+    `_prepare` or `agent_session.resolve` learning that drafts exist.
+    """
+    if draft_service.is_draft(chat_id):
+        draft = draft_service.get(chat_id, user.id)
+        return draft_service.as_chat(draft) if draft is not None else None
+    chat = db.get(Chat, chat_id)
+    return chat if chat is not None and chat.user_id == user.id else None
+
+
 def _prepare(db, user, chat_id: str) -> tuple[str, dict]:
     """Everything that has to be true, and what opening needs. One or the other.
 
@@ -85,8 +100,8 @@ def _prepare(db, user, chat_id: str) -> tuple[str, dict]:
     if not permissions.has(db, user, "agent.terminal"):
         return "You do not have permission to open a terminal.", {}
 
-    chat = db.get(Chat, chat_id)
-    if chat is None or chat.user_id != user.id:
+    chat = _chat_or_draft(db, user, chat_id)
+    if chat is None:
         return "That chat no longer exists.", {}
     if chat.kind != KIND_AGENT:
         return "This is an ordinary chat, so it has no machine to open a shell on.", {}
@@ -205,8 +220,7 @@ async def last_command(db: Db, user: RequiredUser, chat_id: str) -> dict:
     buffer could not produce it anyway: it holds what is on screen, hard-wrapped
     at the terminal's width, with no way to tell a wrap from a newline.
     """
-    chat = db.get(Chat, chat_id)
-    if chat is None or chat.user_id != user.id:
+    if _chat_or_draft(db, user, chat_id) is None:
         raise HTTPException(status.HTTP_404_NOT_FOUND, "That chat no longer exists.")
     if not permissions.has(db, user, "agent.terminal"):
         raise HTTPException(status.HTTP_403_FORBIDDEN, "You cannot open a terminal.")