A terminal panel beside an agent chat

A real shell on the chat's own connection, opened and closed like the
inspector and never beside it. The modes govern the model; what a person
types is theirs, since they hold the credential and could open the same
shell with an ssh client. The model cannot see the panel -- a button
copies the output you choose into the composer.

The session outlives the socket: closing the panel leaves a build
running, and coming back reattaches with the scrollback. Two tabs share
one shell and the smaller window decides the size. It ends on an idle
timeout, on deleting the chat, on disabling, moving or deleting the
connection, and on a restart -- which says why rather than quietly
opening a fresh shell that has lost the working directory.

The nginx template's `Connection ""` is right for SSE and fails every
WebSocket handshake, so `location /` now uses a `map $http_upgrade`;
update.sh grows a drift check for it, because the only symptom on a
stale vhost is a panel that cannot connect.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

deploy/update.sh

@@ -56,9 +56,8 @@ sudo -u "$SERVICE_USER" "$VENV/bin/pip" install --quiet -e "$APP[$LEMBAS_EXTRAS]
 # about the local lines, and a warning that always fires is one nobody reads.
 #
 # The drift is worth catching: a change in the unit can be what makes a release
-# work at all. Dropping ProtectKernelTunables is why an agent chat can start a
-# sandbox, and a host that pulled the code without it would run the new version
-# under the old confinement and fail confusingly.
+# work at all, and a host that pulled the code without it would run the new
+# version under the old settings and fail confusingly.
 STAMP="$PREFIX/.unit-applied"
 current=$(sha256sum "$APP/deploy/lembas.service" | cut -d' ' -f1)
 if [[ -f "$STAMP" && "$(cat "$STAMP")" != "$current" ]]; then
@@ -77,6 +76,48 @@ elif [[ ! -f "$STAMP" ]]; then
   echo "$current" | sudo tee "$STAMP" >/dev/null
 fi
 
+# The same argument for the vhost, and the failure is worse. A stale unit at
+# least says something in the journal; a stale vhost breaks a feature two layers
+# away, and the only symptom is a panel that says it could not connect. The
+# terminal is a WebSocket, and a `location` that does not pass an upgrade
+# through fails every handshake while every test in the suite still passes.
+VHOST_STAMP="$PREFIX/.vhost-applied"
+vhost_now=$(sha256sum "$APP/deploy/nginx-vhost.conf" | cut -d' ' -f1)
+
+site_host=""; app_port="8080"
+# Written by install.sh. Absent on a deployment that predates it, in which case
+# the commands below are a template rather than a copy-paste.
+if [[ -f "$PREFIX/.deploy-env" ]]; then
+  . "$PREFIX/.deploy-env"
+  site_host="$SITE_HOST"; app_port="$APP_PORT"
+fi
+installed_vhost="/etc/nginx/conf.d/${site_host:-your-host}.conf"
+
+vhost_stale=""
+if [[ -f "$VHOST_STAMP" ]]; then
+  [[ "$(cat "$VHOST_STAMP")" != "$vhost_now" ]] && vhost_stale="the template has changed"
+elif [[ -n "$site_host" && -f "$installed_vhost" ]]; then
+  # First run with this check, so there is no stamp to compare against. Rather
+  # than assume what is installed is current -- which is what the unit check
+  # does, and would hide exactly the change this was added for -- look for the
+  # one thing that must be there. Everything else is left to the stamp.
+  grep -q 'lembas_connection_upgrade' "$installed_vhost" \
+    || vhost_stale="the installed vhost does not pass WebSocket upgrades through, so the terminal cannot connect"
+fi
+
+if [[ -n "$vhost_stale" ]]; then
+  echo "== nginx vhost ==" >&2
+  echo "   $vhost_stale." >&2
+  echo "   Review and reinstall it:" >&2
+  echo "     diff $installed_vhost <(sed \\" >&2
+  echo "       -e 's|__SITE_HOST__|${site_host:-your-host}|g' -e 's|__APP_PORT__|$app_port|g' \\" >&2
+  echo "       $APP/deploy/nginx-vhost.conf)" >&2
+  echo "   Then: sudo nginx -t && sudo systemctl reload nginx" >&2
+  echo "   And record it as applied: echo $vhost_now | sudo tee $VHOST_STAMP" >&2
+elif [[ ! -f "$VHOST_STAMP" ]]; then
+  echo "$vhost_now" | sudo tee "$VHOST_STAMP" >/dev/null
+fi
+
 echo "== restart =="
 sudo systemctl restart lembas
 sleep 2