A terminal panel beside an agent chat

A real shell on the chat's own connection, opened and closed like the
inspector and never beside it. The modes govern the model; what a person
types is theirs, since they hold the credential and could open the same
shell with an ssh client. The model cannot see the panel -- a button
copies the output you choose into the composer.

The session outlives the socket: closing the panel leaves a build
running, and coming back reattaches with the scrollback. Two tabs share
one shell and the smaller window decides the size. It ends on an idle
timeout, on deleting the chat, on disabling, moving or deleting the
connection, and on a restart -- which says why rather than quietly
opening a fresh shell that has lost the working directory.

The nginx template's `Connection ""` is right for SSE and fails every
WebSocket handshake, so `location /` now uses a `map $http_upgrade`;
update.sh grows a drift check for it, because the only symptom on a
stale vhost is a panel that cannot connect.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

README.md

@@ -63,6 +63,10 @@ runtime. Clone it, `pip install -e .`, run it.
   but asks before commands, *Auto* asks about nothing, and *Plan* reads freely,
   changes nothing, and finishes by proposing steps you can carry out with one
   button. Adding a host shows you its fingerprint before anything is sent to it
+- **A terminal beside the chat** — the same connection, a real shell, opened and
+  closed like any panel. It survives closing the panel and reloading the page,
+  so a build keeps running; the model cannot see it, and a button hands it the
+  output you choose
 - **It can ask you things** — a model that needs a decision can stop and put a
   few questions on one card, with answers to pick from and a box to write your
   own. In any chat, not only an agent one
@@ -194,6 +198,32 @@ with. In **Auto**, nothing stands between that and a command running.
 switches to *Edit*, never *Auto*, because the plan was written under a mode
 where every command still asked.
 
+#### The terminal
+
+An agent chat has a **Terminal** button in its header, which opens a real shell
+on that chat's connection, in its directory, beside the conversation. It needs
+the *Open a terminal* permission, which is off by default.
+
+The modes above do not apply to it. They exist because a model reads pages,
+files and command output it did not write; you hold the credential and could
+open the same shell with an ssh client, so nothing you type is queued for your
+own approval. The model cannot see the panel either — the button in its header
+puts the selection, or the last of the output, into the message box, where you
+read it before it goes anywhere.
+
+The shell is not tied to the panel. Close it and a build carries on; come back,
+or reload, and you reattach with the scrollback. Two tabs share one shell, and
+the smaller window decides the size. It ends when nobody has watched it and
+nothing has been typed for a while, when the chat is deleted, when the
+connection is disabled or deleted, or when LLeMbas restarts — a deploy cuts off
+whatever was running, and the panel says so rather than quietly opening a fresh
+shell that has lost your working directory.
+
+> Nothing typed here is in the transcript and nothing is logged but the opening
+> and the closing. If you are running this over plain http, note that the
+> session cookie is not marked `secure` so a LAN install works at all — with a
+> terminal switched on, that is worth a certificate.
+
 ### The library
 
 **Sidebar → Library**, and **Settings → Memory**. Nothing is on by default for a