A terminal panel beside an agent chat

A real shell on the chat's own connection, opened and closed like the
inspector and never beside it. The modes govern the model; what a person
types is theirs, since they hold the credential and could open the same
shell with an ssh client. The model cannot see the panel -- a button
copies the output you choose into the composer.

The session outlives the socket: closing the panel leaves a build
running, and coming back reattaches with the scrollback. Two tabs share
one shell and the smaller window decides the size. It ends on an idle
timeout, on deleting the chat, on disabling, moving or deleting the
connection, and on a restart -- which says why rather than quietly
opening a fresh shell that has lost the working directory.

The nginx template's `Connection ""` is right for SSE and fails every
WebSocket handshake, so `location /` now uses a `map $http_upgrade`;
update.sh grows a drift check for it, because the only symptom on a
stale vhost is a panel that cannot connect.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/test_agent_ssh.py

@@ -117,7 +117,7 @@ def test_the_dangerous_defaults_are_all_passed_explicitly():
     """Every LLeMbas user shares one unix account, so "whatever the account has
     lying around" is never the right answer. This is the most important test in
     the file and it needs no server at all."""
-    kwargs = ssh._connect_kwargs(_spec(22, "127.0.0.1 ssh-ed25519 AAAA\n"))
+    kwargs = ssh.connect_kwargs(_spec(22, "127.0.0.1 ssh-ed25519 AAAA\n"))
 
     # Bytes, never None: None turns host key checking off entirely.
     assert isinstance(kwargs["known_hosts"], bytes)
@@ -132,11 +132,11 @@ def test_the_dangerous_defaults_are_all_passed_explicitly():
 
 def test_a_profile_with_no_confirmed_host_key_refuses_to_connect():
     with pytest.raises(ExecError, match="host key has not been confirmed"):
-        ssh._connect_kwargs(_spec(22, ""))
+        ssh.connect_kwargs(_spec(22, ""))
 
 
 def test_a_password_profile_sends_a_password_and_no_keys():
-    kwargs = ssh._connect_kwargs(
+    kwargs = ssh.connect_kwargs(
         _spec(22, "h ssh-ed25519 AAAA\n", auth="password", password="hunter2")
     )
     assert kwargs["password"] == "hunter2"
@@ -144,7 +144,7 @@ def test_a_password_profile_sends_a_password_and_no_keys():
 
 
 def test_a_key_profile_sends_no_password():
-    kwargs = ssh._connect_kwargs(_spec(22, "h ssh-ed25519 AAAA\n", password="stale"))
+    kwargs = ssh.connect_kwargs(_spec(22, "h ssh-ed25519 AAAA\n", password="stale"))
     assert kwargs["password"] is None