A terminal panel beside an agent chat

A real shell on the chat's own connection, opened and closed like the
inspector and never beside it. The modes govern the model; what a person
types is theirs, since they hold the credential and could open the same
shell with an ssh client. The model cannot see the panel -- a button
copies the output you choose into the composer.

The session outlives the socket: closing the panel leaves a build
running, and coming back reattaches with the scrollback. Two tabs share
one shell and the smaller window decides the size. It ends on an idle
timeout, on deleting the chat, on disabling, moving or deleting the
connection, and on a restart -- which says why rather than quietly
opening a fresh shell that has lost the working directory.

The nginx template's `Connection ""` is right for SSE and fails every
WebSocket handshake, so `location /` now uses a `map $http_upgrade`;
update.sh grows a drift check for it, because the only symptom on a
stale vhost is a panel that cannot connect.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

deploy/nginx-vhost.conf

@@ -7,6 +7,19 @@
 # install.sh generates. To use a real certificate, point ssl_certificate at it;
 # nothing else here needs to change.
 
+# The terminal panel is a WebSocket, and a proxy that does not pass an upgrade
+# through breaks it with no error either side can report -- the browser sees a
+# failed handshake, which carries no status and no reason. This map yields
+# "upgrade" only when the client asked for one and the empty string otherwise,
+# which is exactly what the streamed-reply case below needs, so one `location`
+# serves both. `conf.d/*.conf` is included inside `http {}`, where `map` is
+# legal; the name is prefixed because two vhosts from this template would
+# otherwise collide.
+map $http_upgrade $lembas_connection_upgrade {
+    default upgrade;
+    ''      '';
+}
+
 server {
     listen 80;
     listen [::]:80;
@@ -42,9 +55,13 @@ server {
         proxy_buffering         off;
         proxy_request_buffering off;
         proxy_cache             off;
-        # SSE is plain HTTP/1.1 chunked, not a websocket upgrade, so the
-        # connection header must simply be left to keep-alive.
-        proxy_set_header Connection "";
+        # SSE is plain HTTP/1.1 chunked and needs Connection left empty; the
+        # terminal is a real upgrade and needs it set. The map at the top of
+        # this file is what lets one location do both -- a hard-coded
+        # `Connection ""` here, which is what was here before, works for every
+        # streamed reply and silently breaks every terminal.
+        proxy_set_header Upgrade    $http_upgrade;
+        proxy_set_header Connection $lembas_connection_upgrade;
 
         # A model can think for minutes before the first token. The default
         # 60s read timeout would cut long generations off mid-sentence.